Germany arrests member of Qilin hacker group who was extradited from Japan

A Russian national believed to be a key member of the notorious Qilin international hacker group was arrested by German authorities after being extradited from Japan, Japanese police said Thursday.

According to the National Police Agency, German authorities had obtained an arrest warrant for the 28-year-old Russian citizen on suspicion of extortion for allegedly attacking German companies and demanding cryptocurrency payments.

After learning that he planned to visit Japan as a tourist in May, the agency’s cyber special investigation department identified his whereabouts through a joint investigation involving the Tokyo, Osaka and Kyoto police departments.

He was detained at a hotel in Osaka that month and handed over to German authorities this month following a decision by the Tokyo High Court under the extradition law.

Qilin has launched ransomware attacks worldwide since October 2022, affecting about 4,000 companies. It demands ransom payments to restore encrypted data and threatens to release stolen data if victims refuse to pay.

Since April 2023, it has hit 53 companies, hospitals and schools in Japan. The group claimed responsibility for a cyberattack on Asahi Group Holdings in 2025.

Qilin operates through numerous affiliates that carry out cyber intrusions and extortion attempts using ransomware provided by core members responsible for malware development and system management.

“It was significant that we identified and arrested a (Qilin) member through international cooperation,” a senior NPA official said.