Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany

German authorities have taken custody of a 28-year-old Russian national suspected of being a core member of the Qilin ransomware operation, after his arrest in Osaka, Japan in May and his handover on October 2. He is wanted in Germany over a September 2024 breach of a logistics company, where he allegedly encrypted systems and extorted the victim for more than $160,000 in cryptocurrency. Qilin, also known as Agenda, has run as a ransomware-as-a-service operation since August 2022 and is tied to major incidents including the 2024 Synnovis attack that disrupted London NHS hospitals, the 2025 breach of Asahi Group affecting roughly 2 million people, and roughly 400 victims posted to its leak site this year, including Lee Enterprises, Inotiv and the US ATF. The arrest marks a rare law-enforcement success against one of the most active and damaging RaaS groups currently operating.