Overview
- German authorities say a 28‑year‑old Russian identified as Vladimir K., known online as “snake,” was arrested in Osaka in May and handed over to Germany in early October to face charges as a core developer for the Qilin ransomware group.
- Investigators from North Rhine‑Westphalia infiltrated Qilin’s systems and monitored the network for months, using that access to trace the suspect’s activity and travel plans that led to the May arrest.
- Prosecutors allege Vladimir K. helped build and operate Qilin’s malware and was involved in a September 2024 attack on a German logistics firm that demanded about $165,000 in Bitcoin for stolen data.
- Authorities describe Qilin as a Ransomware‑as‑a‑Service network that since 2022 has sought roughly $2.9 billion in ransoms and taken about $140 million in payments by combining data theft with encryption.
- Officials warn the arrest will aid forensic analysis and criminal cases but say several senior suspects remain at large, likely in Russia, making full disruption of the group unlikely and extraditions difficult to repeat.