Loading story…
Japan extradited a 28-year-old Russian man to Germany in early October over his alleged involvement in the Qilin ransomware group. The suspect allegedly developed ransomware and directly manipulated systems at a German logistics company compromised in September 2024. According to reporting citing Asahi Shimbun, the company paid a Bitcoin ransom to prevent publication of stolen data, and part of that payment allegedly reached the suspect, providing the basis for a German arrest warrant. His alleged role has not been proven.
Japanese authorities arrested the man in Osaka in May after obtaining confirmation of the German warrant from the Tokyo High Court. The handover is unusual because Japan has extradition treaties only with South Korea and the United States, highlighting cross-border enforcement against ransomware suspects outside established treaty relationships. Qilin has been linked to ransomware attacks against companies worldwide, including Japan’s Asahi brewery, but the reporting does not establish this suspect’s involvement in the brewery attack.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
Japan’s National Police Agency confirmed the arrest and extradition to Germany of a 28-year-old Russian national accused of Qilin involvement and participating in a ransomware attack on a German company. The report says Japanese authorities arrested him at an Osaka hotel in May and extradited him in June.
The US Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed that it had suffered a cyberattack after Qilin added the agency to its leak site.
In September 2024, Qilin compromised an unnamed German logistics company’s IT systems and extorted the company. The Russian suspect later extradited to Germany allegedly manipulated the company’s systems himself.
Qilin was associated with a 2024 ransomware attack against Synnovis, a UK medical services provider whose systems were used by several London hospitals. The attack significantly disrupted healthcare operations.
Qilin attacked Japanese carmaker Nissan. The reference does not specify the attack's timing or impact.
German authorities arrested a Russian national suspected of being a leading Qilin ransomware member following his extradition from Japan. Germany had obtained an arrest warrant in connection with a ransomware incident in Germany.
Japan extradited the 28-year-old Russian suspect to Germany in early October to face criminal proceedings. The handover was unusual because Japan has extradition treaties only with South Korea and the United States.
Authorities arrested the Russian suspect in Osaka in May. He was alleged to be an important Qilin member who developed ransomware and participated directly in the German logistics company attack.
Authorities obtained confirmation of the German arrest warrant from the Tokyo High Court before arresting the suspect. Investigators reportedly knew in advance that he would travel to Japan.
The article reports that Qilin attacked Germany’s Die Linke political party in March, without explicitly specifying the year.
Qilin attacked Japan’s Asahi brewery, disrupting beer supplies and production of nonalcoholic beverages and other food products. The report does not establish that the extradited suspect participated in this attack.
According to Asahi Shimbun, the company paid a Bitcoin ransom to prevent publication of stolen data. Part of the payment allegedly reached the Russian suspect, helping form the basis of the German arrest warrant.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
12 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcecysecurity.news
Open sourcemalware.news
Open sourcejapantimes.co.jp
Open sourceasahi.com
Open sourcenpa.go.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Japanese police reported **226 ransomware incidents** in 2025, the second-highest annual total on record and four more than the previous year, with roughly **60% of victims identified as small and midsize businesses**. The National Police Agency said prolonged disruption was associated with higher recovery costs, while major enterprises were also affected, including **Asahi Group Holdings** and **Askul**. Among the 149 cases where malware families were identified, **Qilin** was the most common with 32 cases, followed by **LockBit** with 19; **8Base** appeared only once, reflecting the impact of international law-enforcement action and the availability of a recovery tool. Regional reporting also showed **Qilin** active outside Japan, including attacks on a South Korean dermatology clinic and the Korean branch of a global advertising company, underscoring the group’s continued presence in East Asia. One other article in the set describes a dramatic “printer” compromise at an unnamed business, but it appears to be a standalone blog narrative about a different and unverified incident rather than the same reported ransomware trend. Overall, the relevant reporting points to sustained ransomware pressure on both SMBs and larger organizations, with **Qilin** remaining a prominent threat actor/toolset in the region.
Jun 29, 2026
The **Qilin** ransomware group claimed multiple new victims across the United States, Canada, Austria, and Germany, hitting organizations in manufacturing, professional services, financial services, media, retail, property management, and utilities. Named victims included Community Management Associates, Pointe Property Group, Ceragres, Dienst Pack Systems, Schreiner Trockenbau GmbH, Commercial Furniture Interiors, *The Saturday Evening Post*, Wire Products, Freedom Claims Management, and Service Electric. Several reports described the incidents as both ransomware attacks and associated data breaches, indicating continued emphasis on extortion through stolen data as well as operational disruption. Separate reporting tied Qilin affiliates to active exploitation of Internet-facing VPN and firewall infrastructure, including **Palo Alto GlobalProtect** `CVE-2026-0257` and **Check Point VPN** `CVE-2026-50751`, as part of broader mid-2026 ransomware access campaigns. That activity was reported alongside common post-compromise tradecraft such as Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI, browser credential theft, and use of WSL for EDR evasion. A weekly ransomware trend report counted Qilin among the most active groups, with **31 claimed victims** during the period, reinforcing its position as a leading extortion threat affecting organizations across sectors and regions.
Aug 10, 2026
The **Qilin** ransomware group has claimed responsibility for a cyberattack on **Die Linke**, a German political party, and threatened to leak allegedly stolen data on its Tor-based extortion site. Die Linke disclosed the incident shortly after detecting the compromise, took parts of its IT infrastructure offline, notified staff, alerted German authorities, and filed a criminal complaint. The party said the attack appeared to target sensitive internal party information and personal data belonging to employees at party headquarters. Die Linke said its **membership database was not affected** and that no member data was stolen, although it warned that internal records and employee information may be at risk. Qilin later added the party to its leak site without publishing proof-of-theft samples. The group is described as a **Russian-speaking ransomware-as-a-service** operation known for **double-extortion** tactics, and Die Linke said the incident may not have been random, citing both financial and possible political motives as independent IT experts work to restore affected systems.
Jun 29, 2026