Qilin is the largest ransomware group in the world
Assessment
Several outlets covering the extradition described Qilin as the world's largest or most active ransomware operation. Qilin was indeed highly active in 2025 — Cisco Talos attributed 16.4% of reported Japanese ransomware incidents to it — but 'largest in the world' is a ranking that varies by methodology (victim count, leak-site posts, revenue) and time window, and analyses reviewed for this paper note no single named threat-intelligence firm has certified Qilin as the outright largest. It is a defensible assessment at a point in time, not a settled fact.
Where this claim appeared
UNN · 2026-10-07
https://unn.ua/en/news/germany-extradited-from-japan-a-russian-hacker-accused-of-working-for-the-largest-ransomware-groupWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Qilin ransomware operator extradited from Japan to Germany: what the record shows, and what it does notThink this assessment is wrong? Report an error.