Japan’s National Police Agency has confirmed that a Russian citizen sought under a German arrest warrant was detained in Japan and extradited to Germany. The Qilin suspect extradited Germany case concerns alleged ransomware-related extortion, not a proven role in the Qilin operation.
Japanese police said Germany’s warrant concerned a ransomware incident in Germany. Jiji Press, carried by Nippon.com, reported that the 28-year-old Russian national is suspected of extortion after alleged attacks on German companies and demands for cryptocurrency payments. Authorities have not publicly named him.
The available reports do not identify the affected German company or companies, describe the specific alleged conduct, or state the status or location of any German court proceedings. They also do not specify any subsequent German charging decision.
Why did Japan extradite the Russian Qilin suspect to Germany?
According to a Japanese police account reproduced by BleepingComputer, Germany had obtained an arrest warrant connected to a ransomware case and worked with Japanese authorities to secure provisional detention and extradition under Japan’s Extradition Law for Fugitives. The Japanese Ministry of Justice and Tokyo High Public Prosecutors Office participated alongside German authorities, the account said.
Police learned that the man planned to visit Japan as a tourist in May, according to Jiji Press. The National Police Agency’s cyber special investigation department located him with the Tokyo Metropolitan Police Department and police in Osaka and Kyoto. He was detained at a hotel in Osaka that month.
The basic sequence is consistent across the reports: a May detention in Osaka followed by transfer to Germany. The transfer date is not. The Record, citing Nippon, reported that he was sent to Germany in June. BleepingComputer described the extradition as occurring earlier in October, while Jiji Press reported that Japanese authorities handed him to Germany in October after a Tokyo High Court decision. The conflicting news reports do not establish which date is correct.
What is Qilin ransomware?
Qilin is a ransomware operation that encrypts a victim’s data and demands payment for restoration, while also threatening to publish data allegedly stolen before or during the attack if the victim refuses. That second pressure tactic is commonly called double extortion.
The reporting identifies the detained man as believed or alleged to be linked to Qilin, but the supplied evidence does not establish that as a court finding. It also contains differing estimates of the operation’s reach: Jiji Press reported about 4,000 affected companies since October 2022, while BleepingComputer cited more than 2,350 known organizations in 62 countries. Those figures are media-reported estimates, not a confirmed count in this case.
Germany had not provided further comment in reporting by The Record. For now, Japan’s confirmation establishes the cross-border detention and extradition, while the allegations against the unnamed suspect remain allegations to be addressed in Germany.
This story draws on original reporting from The Record.
