Japanese authorities arrested a 28-year-old Russian national alleged to be a core member of the Qilin ransomware gang and extradited him to Germany. German prosecutors want him for a September 2024 attack on a logistics company in which systems were hacked, files were encrypted, and more than $160,000 in cryptocurrency was extorted. Qilin, also known as Agenda, is a ransomware-as-a-service operation tied to major incidents including the Synnovis attack on UK healthcare and later exploitation of Check Point VPN zero-day CVE-2026-50751.
Why it matters: This is a significant law-enforcement action against one of the most active ransomware groups, showing operators can still face arrest across borders. Organizations hit by Qilin or tracking its tactics should note the continued threat from the group even as authorities pursue members.
Ionut Arghire
2026.10.07
100% relevant
This article establishes a distinct law-enforcement story focused on the arrest and extradition of an alleged Qilin operator tied to a specific 2024 ransomware and extortion attack.
← Back to all stories