Germany Extradites Alleged Qilin Developer After International Investigation
Summary
A 21-month investigation led to the arrest in Japan and extradition to Germany of a Russian national accused of working as a Qilin developer. Investigators say victim reporting, forensic evidence, intelligence sharing and cryptocurrency analysis helped build the case.
Key points
- German authorities say Vladimir K., a 28-year-old Russian national, was arrested in Osaka on May 26, 2026, and extradited to Germany on October 2.
- He is accused of involvement in Qilin-related computer intrusions, data encryption and ransom extortion, and of working primarily as a developer.
- The investigation began after a September 2024 ransomware attack on an unnamed German logistics company, which reportedly paid about $100 million.
- Investigators reportedly used forensic and financial clues to monitor Qilin activity, trace cryptocurrency flows and connect online activity to the suspect.
- German authorities have identified three other leading Qilin members, believed to be in Russia and beyond the reach of Western authorities.
- The article says victim reports and cross-border cooperation helped investigators connect separate evidence and pursue the case through arrest and extradition.
Article Details
- Event Type
- International law-enforcement investigation resulting in the arrest in Japan and extradition to Germany of a suspect alleged to be associated with the Qilin ransomware operation.
- Impact
- German authorities allege that Vladimir K. worked primarily as a Qilin developer and significantly participated in ransom-extortion profits. The arrest followed a 21-month investigation that reportedly used forensic evidence, intelligence sharing, infrastructure analysis, and cryptocurrency tracing. The article reports that the suspect was arrested in Osaka on May 26, 2026, and extradited to Germany on October 2, 2026. The investigation also identified at least three other Qilin members, believed to be in Russia; their identities were not disclosed.
People
Threat Actors
Countries
GermanyHow Germany and Japan turned a ransomware attack into an international investigationJapanHow Germany and Japan turned a ransomware attack into an international investigationRussiaThe operation has dominated the ransomware ecosystem since the first half of 2025 and is said to be operated from Russia or another former Soviet state with a global network of affiliates.
Industries
HealthcareAttacks on private and public healthcare: The group and its affiliates claimed hospitals, medical groups, and other healthcare service providers as victims.logisticsIt seems to have started with what Qilin would call a ‘successful’ ransomware attack against an unnamed German logistics company in September of that year.