German authorities have arrested a 28-year-old Russian suspected of being a core Qilin ransomware member after Japan detained him and extradited him to Germany. Japanese authorities confirmed that German investigators had an arrest warrant tied to a ransomware attack in Germany. Japan’s National Police Agency said the suspect was located after he was spotted traveling to Japan as a tourist, and the extradition was carried out under Japan’s fugitive-transfer law. German police suspect the man of involvement in a September 2024 ransomware attack against a German logistics company. The company’s systems were allegedly encrypted, and stolen data was used as leverage in an extortion demand. SecurityWeek reported that the victim paid more than $160,000 in cryptocurrency. The suspect has not been convicted, and the case remains subject to German criminal proceedings. The operation relied on coordinated cross-border steps. Japanese investigators were alerted after learning the suspect planned to enter Japan. Japan’s Ministry of Justice, the Tokyo High Public Prosecutors Office, and German authorities coordinated the extradition process, using a provisional detention warrant under Japan’s extradition law. Japanese reporting says the handover to German authorities took place in early October. Officials in North Rhine-Westphalia said the arrest came from an investigation in which German authorities infiltrated and monitored the group for months. Investigators describe Qilin as operating through a “core and affiliates” structure, with core operators maintaining ransomware infrastructure while affiliates carry out intrusions and attacks, and profits divided between the two. Qilin first emerged in 2022 under the name Agenda and has been linked to thousands of victim organisations across dozens of countries, including major names such as Asahi Group and Nissan. German investigators said the arrested man held a significant position within Qilin rather than acting only as an outside affiliate. The latest status is that the suspect is arrested in Germany and faces ongoing criminal proceedings connected to the September 2024 ransomware attack.