Japan’s National Police Agency has officially confirmed that it detained a Russian national wanted in Germany over a ransomware attack and handed him to German authorities, The Record reported Friday. The man is suspected of having led Qilin, one of the most active ransomware groups of the past two years, and the case shows how foreign travel can bring suspected cybercriminals within reach of Western warrants.

The arrest itself is not new. Japanese media reported it earlier in the week, and SecurityWeek covered the transfer on Oct. 7. What changed this week is that Japan put its role on the record. The suspect has not been convicted of any crime, and his name has not been released.

What Happened

In a two-page release dated Oct. 8 and published in Japanese, the agency said Germany had announced the arrest of a Russian national believed to have led Qilin, and that the German announcement acknowledged help from Japanese police.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

According to the release, the cyber special investigation unit of the Kanto Regional Police Bureau and other local police forces had been investigating ransomware cases in Japan together with Germany. When the suspect, for whom Germany had obtained an arrest warrant over a ransomware case on German soil, came to Japan, police worked with the Justice Ministry, the Tokyo High Public Prosecutors Office and German officials. They held him under a provisional detention permit, a warrant that allows a person sought by another country to be held while extradition proceeds, and then transferred him under the procedures of Japan’s extradition law.

The release gives no dates. The Record, citing the outlet Nippon.com, reported that the 28-year-old was detained at an Osaka hotel in May after officials learned he planned a vacation in Japan, and that he was sent to Germany in June. SecurityWeek, citing a U.K. outlet, put the handover at Oct. 2. SecurityWeek also reported that the German case concerns a September 2024 intrusion at a logistics company whose systems were encrypted and from which more than $160,000 in cryptocurrency was extorted. German law enforcement did not respond to The Record’s request for comment.

Why It Matters

Qilin runs as ransomware-as-a-service, meaning its core operators supply the malicious software and infrastructure while affiliates carry out break-ins and share the ransom. It typically steals data before encrypting systems, then threatens to publish it. BleepingComputer, citing recent tallies, reported that the group has targeted more than 2,350 known organizations in 62 countries since it appeared in August 2022 under the name Agenda.

Its reach into U.S. institutions is documented. In August, Qilin claimed an attack on the Bureau of Alcohol, Tobacco, Firearms and Explosives, which later confirmed a major incident, according to BleepingComputer and SecurityWeek. BleepingComputer and SecurityWeek name newspaper publisher Lee Enterprises among earlier U.S. victims, and The Record lists the city of Sugar Land, Texas. Outside the U.S., SecurityWeek tied the group to the 2024 attack on British health care company Synnovis that disrupted London hospitals and the 2025 attack on Japanese brewer Asahi.

For boards, the takeaway is mixed. The arrest shows that police in Germany and Japan can investigate jointly and act quickly when a suspect travels. But BleepingComputer reported that Qilin listed more than 450 victims on its leak site from June onward, after the May detention. Removing one person, even a suspected leader, does not reduce the exposure of organizations running the VPN gateways and firewalls that BleepingComputer and SecurityWeek say the group has exploited.

Context

Researchers ranked Qilin the second most active ransomware gang in July, with 127 reported attacks that month, The Record reported. The agency’s release noted that ransomware attacks hit Japan and other countries on a global scale, and said cooperation with foreign investigators is essential to pursuing them.

What to Watch

  • Whether German prosecutors identify the suspect, file formal charges and set out how they link him to Qilin’s leadership.
  • Any change in the volume of new victims on Qilin’s leak site, or signs that affiliates move to other ransomware brands.
  • Whether German or Japanese authorities release more details, including the transfer date and any other suspects tied to the investigation.