A Russian man aged 28, believed to be a core member of the ransomware group Qilin, which has carried out repeated cyberattacks around the world, was detained in Japan and handed over to German authorities on October 2, the Asahi Shimbun reported on the 6th. According to the report, the man is suspected of illegally accessing the terminal of a German logistics company in September 2024, unlawfully obtaining and encrypting data, and then threatening the company by demanding bitcoin worth 165,000 dollars, or about 26 million yen, in exchange for not publishing the data. The man is said to have been responsible for building the systems Qilin used in its attacks, and it was also confirmed that he received a portion of the ransom payments within a structure in which multiple operational units carried out ransomware attacks. Japanese investigative authorities had prior information about the man's whereabouts, detained him in late May while he was traveling in Osaka, and the Tokyo High Court subsequently ruled that extradition was possible, after which he was handed over to German authorities under the Act on International Assistance in Investigation and Other Related Matters. Qilin is known as a RaaS, or ransomware-as-a-service, criminal group in which the developers and operators of the ransomware are separate from the affiliates who carry out the actual attacks. It also issued a claim of responsibility for the cyberattack on Asahi Group Holdings in September 2025, which affected the company's order and shipping operations, but it is not clear whether the man detained in this case was personally involved in the attack on Asahi.
Asahi Group Holdings LtdQilin claimed responsibility for the September 2025 cyberattack on Asahi Group Holdings that disrupted its order and shipping operations, though the detained man's involvement is unclear.
Bitcoin
