Overview
- German police say a 28-year-old Russian, identified by investigators as Vladimir K. and known online as “snake,” was extradited from Japan to Germany in early October 2026 and is now in pretrial detention.
- Authorities allege he helped develop Qilin’s ransomware and personally took part in a September 2024 attack on a German logistics firm that stole data, encrypted systems, and demanded about $165,000 in Bitcoin.
- Investigators in North Rhine-Westphalia say they infiltrated Qilin’s infrastructure and monitored the group for months, which let them observe the suspect ‘live at work’ and track travel plans that led to his May 2026 arrest in Osaka.
- Japan’s decision to hand the suspect to Germany is unusual because the two countries lack a bilateral extradition treaty, a move officials say reflects deeper law-enforcement cooperation and recent Japanese reforms on cybercrime.
- Officials say several other core Qilin members have been identified but are likely in Russia, which limits immediate wider prosecutions while German investigators prepare charges and share evidence with partners.