A 28-year-old Russian national believed to be a core member of the Qilin (also called Agenda) ransomware group was detained in Osaka, Japan, in May 2026 and handed over to German authorities on 2 October, SecurityWeek reported on 7 October. Germany wants him for breaking into a logistics company in September 2024, encrypting its data and extorting more than US$160,000 in cryptocurrency. Qilin has run as a ransomware-as-a-service operation since August 2022 and is one of the most active groups: it was blamed for the 2024 Synnovis pathology attack that disrupted London NHS hospitals, claimed the Asahi Group attack, listed about 400 victims on its leak site in 2025, and this year exploited the Check Point VPN and firewall authentication bypass CVE-2026-50751.

Qilin listings regularly name Australian organisations, and the group was named after the August 2026 cyber incident at the US ATF.

Neither the suspect's name nor a German prosecutor's statement has been published in the reporting.

Source: SecurityWeek.

UPDATE (8-9 Oct): Japan's National Police Agency confirmed the case in a press release dated 8 October 2026. It says Germany has announced the arrest of a Russian national believed to have led the Qilin group, and that after the suspect, wanted on a German warrant over a ransomware attack in Germany, arrived in Japan, the Kanto Regional Police Bureau's cyber investigation unit and local police worked with the Ministry of Justice, the Tokyo High Public Prosecutors Office and Germany to hold him on a provisional detention warrant under Japan's extradition law and hand him over.

BleepingComputer reported on 9 October that he had entered Japan as a tourist, and noted that Qilin has hit more than 2,350 known organisations in 62 countries, including Australia's Court Services Victoria, and has listed more than 450 victims since June. The suspect has still not been named.