Story · 2 sources · 2 articlesfirst Oct 6, 12:00 UTCupdated Oct 7, 13:47 UTC (1d ago)

Russia-Born Suspected Qilin Ransomware Core Member Extradited from Japan to Germany

mediumPolicy & legalimportance 65CVE-2026-50751

What's new: First merged summary for this story, combining DataBreaches.net and SecurityWeek coverage. SecurityWeek's later report added specifics absent from DataBreaches.net: the suspect's age (28), arrest location and month (Osaka, May), extradition date (October 2), the underlying German case (September 2024 logistics-company intrusion, $160,000+ crypto extortion), Qilin's start date (August 2022),…

Merged summary · glm-5.3 · rewritten as coverage arrives

A 28-year-old Russian national, allegedly a core member of the Qilin (Agenda) ransomware group, was arrested in Osaka in May and handed to German authorities on October 2 over a $160,000 cryptocurrency extortion.

Japanese police arrested a 28-year-old Russian national — described as a key/core member of the Qilin (Agenda) ransomware group — in Osaka in May 2026 and extradited him to Germany on October 2. German authorities are pursuing him for a September 2024 intrusion into a logistics company in which systems were encrypted and more than $160,000 in cryptocurrency was extorted. Qilin, active since August 2022, is blamed for ransomware attacks against companies worldwide, including the Synnovis attack that disrupted London NHS hospitals and the Asahi Group breach that compromised the data of roughly 2 million people. The group listed 400 victims on its leak site in 2025 and in June exploited Check Point vulnerability CVE-2026-50751. Both reports agree on the extradition and the suspect's alleged seniority; SecurityWeek supplies the more specific details (age, arrest location and month, extradition date, and extortion amount).

Suspect is a 28-year-old Russian national, described as a key/core member of the Qilin (Agenda) ransomware group.
Arrested by Japanese police in Osaka in May; extradited to Germany on October 2.
Germany seeks prosecution for a September 2024 intrusion into a logistics company that encrypted systems and extorted over $160,000 in cryptocurrency.
Qilin has been active since August 2022 and has claimed ransomware attacks worldwide, including in 2025.
Qilin is blamed for the Synnovis attack that disrupted London NHS hospitals and the Asahi Group breach affecting roughly 2 million people's data.
The gang listed 400 victims on its leak site in 2025.
The group exploited Check Point vulnerability CVE-2026-50751 in June.
The two reports do not conflict; SecurityWeek provides the more specific figures and dates.

Threat actorsQilin

MalwareQilin

OrganizationsSynnovis Asahi Group ATF

CountriesJapan Germany Russia

Coverage timelineoldest first · each row is one article

Oct 6, 12:00 UTC · 2d ago
DataBreaches.net· 60
Japan hands over ‘Qilin’ hacker group member to Germany
Japan extradited a suspected Russian Qilin ransomware member to Germany.
Oct 7, 13:47 UTC · 1d ago
SecurityWeek· 65
Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
A 28-year-old Russian alleged core Qilin ransomware member, arrested in Osaka, was extradited to Germany over a $160,000 crypto extortion.

Vulnerabilities in this storyAll →

CVE-2026-507519.385%
Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways
published Jun 8, 2026· Check Point Security Gateway (Gaia OS) KEV ransomware PoC

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-50751	Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways Check Point has disclosed CVE-2026-50751, a critical (CVSS 9.3) improper authentication flaw (CWE-287) in the certificate validation logic for Remote Access and Mobile Access VPN when the deprecated IKEv1 key exchange is used. An unauthenticated remote attacker can exploit this logic flow weakness during IKEv1 negotiation to bypass user authentication entirely. Successful exploitation lets the attacker establish a remote access VPN connection without a valid user password, gaining access to the organization's internal network resources (high confidentiality impact per the CVSS score). Any organization running a Check Point Security Gateway on Gaia OS or Gaia Embedded with IKEv1-based Remote Access/Mobile Access configured is affected; specific affected and fixed versions are in Check Point's advisory. The flaw is being exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 with known ransomware use and an EPSS of 83.8% — and it was disclosed alongside other critical Check Point VPN certificate flaws per recent headlines. Do: Upgrade affected Security Gateways to the fixed releases identified in Check Point's advisory (version numbers are not specified in the source data), prioritizing internet-facing VPN gateways; as an interim mitigation, move Remote Access/Mobile Access clients to IKEv2 or disable IKEv1. Review VPN authentication logs for sessions established without valid credentials, given known in-the-wild and ransomware exploitation. Federal agencies must apply mitigations per BOD 22-01, and defenders should beware of fake 'public PoC' repositories spreading malware (ChocoPoC RAT), since no legitimate public PoC is known.	9.3	85%	KEV ransomware PoC	Check Point Security Gateway (Gaia OS) Check Point Security Gateway (Gaia Embedded)	massplausibly on the order of 100,000+ internet-exposed Check Point gateways, with the IKEv1-affected subset likely tens of thousands of sites (estimate)	Jun 8, 2026 KEV Jun 8, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-50751

Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways

Check Point has disclosed CVE-2026-50751, a critical (CVSS 9.3) improper authentication flaw (CWE-287) in the certificate validation logic for Remote Access and Mobile Access VPN when the deprecated IKEv1 key exchange is used. An unauthenticated remote attacker can exploit this logic flow weakness during IKEv1 negotiation to bypass user authentication entirely. Successful exploitation lets the attacker establish a remote access VPN connection without a valid user password, gaining access to the organization's internal network resources (high confidentiality impact per the CVSS score). Any organization running a Check Point Security Gateway on Gaia OS or Gaia Embedded with IKEv1-based Remote Access/Mobile Access configured is affected; specific affected and fixed versions are in Check Point's advisory. The flaw is being exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 with known ransomware use and an EPSS of 83.8% — and it was disclosed alongside other critical Check Point VPN certificate flaws per recent headlines.

Do: Upgrade affected Security Gateways to the fixed releases identified in Check Point's advisory (version numbers are not specified in the source data), prioritizing internet-facing VPN gateways; as an interim mitigation, move Remote Access/Mobile Access clients to IKEv2 or disable IKEv1. Review VPN authentication logs for sessions established without valid credentials, given known in-the-wild and ransomware exploitation. Federal agencies must apply mitigations per BOD 22-01, and defenders should beware of fake 'public PoC' repositories spreading malware (ChocoPoC RAT), since no legitimate public PoC is known.

9.3

85%

KEV ransomware PoC

Check Point Security Gateway (Gaia OS)
Check Point Security Gateway (Gaia Embedded)

massplausibly on the order of 100,000+ internet-exposed Check Point gateways, with the IKEv1-affected subset likely tens of thousands of sites (estimate)

Jun 8, 2026

KEV Jun 8, 2026