As The Insider writes, Vladimir K., known by the nickname snake, was detained in Osaka on May 26 when he came to Japan on vacation with his girlfriend. On October 2, he was flown from Tokyo to Frankfurt, and he is now in custody.
According to the state criminal police office of North Rhine-Westphalia, K. worked for Qilin primarily as a developer and received a significant share of the ransoms. German investigators consider him one of the group's key members.
Qilin appeared in 2022 under the name Agenda and rents out infrastructure for ransomware attacks to other criminals in exchange for a share of the profits. Germany's Federal Criminal Police Office considers Qilin a criminal organization.
The Russian man was identified after Qilin's attack on a logistics company in North Rhine-Westphalia in September 2024: at that time, the group demanded $165,000 in bitcoin. During an undercover investigation, police infiltrated the Qilin network and K.'s computer, and then learned of his plans to travel to Japan and warned their Japanese colleagues.
There is no extradition treaty between Germany and Japan, but extradition is possible after review. According to the investigation, 152 organizations in Germany were affected by Qilin's actions: they were demanded to pay more than $70 million, and about one-tenth of that amount was paid. Over four years, the group attempted to obtain $2.9 billion, and the victims transferred more than $140 million to it. The state's interior minister Herbert Reul said this was “the biggest blow German investigators have managed to deal in the fight against cybercrime”; the identities of three other key Qilin members have been established, but they are believed to be in Russia.
Sources
