21 months, $100 million, one Qilin suspect in custody

How Germany and Japan turned a ransomware attack into an international investigation

Key takeaways

• A single ransomware attack triggered a 21-month investigation spanning multiple jurisdictions.
• Victim reporting, forensic evidence, intelligence sharing, and cross-border law-enforcement cooperation helped investigators connect ransomware activity to a real-world suspect.
• Even one of the world's most successful ransomware groups proved vulnerable to sustained law-enforcement investigation and international cooperation.

German authorities have announced they have arrested a 28-year-old Russian national for alleged activity associated with Qilin. The 28-year-old Russian national, Vladimir K., was taken into custody during a visit to Japan in May of this year. The suspect was extradited to Germany on October 2.   

Qilin is a financially motivated ransomware-as-a-service (RaaS) operation that we profiled in July 2025, and again in January 2026. The operation has dominated the ransomware ecosystem since the first half of 2025 and is said to be operated from Russia or another former Soviet state with a global network of affiliates.

When we profiled Qilin in July 2025, we questioned whether the group could survive its own success. As Qilin was building its dominance in the threat landscape, it was also creating its own perfect storm:

• Aggressive targeting: Relentless, opportunity-driven campaign across countries, industries, and organization sizes. The Qilin leak site recorded more than 40 victim postings in nearly every month of 2025, with approximately 100 in June and a similar number in August.
• Rapid growth: Qilin operators capitalized on disruption elsewhere in the ransomware ecosystem, attracting experienced affiliates after RansomHub went dormant in April 2025. Its average monthly victim count reportedly rose from about 35 to nearly 70, establishing it as a leading ransomware operation.
• Attacks on private and public healthcare: The group and its affiliates claimed hospitals, medical groups, and other healthcare service providers as victims. Not all claimed attacks were confirmed, but they all came after the 2024 attack that contributed to 170 cases of patient harm and one patient death.

These characteristics normally attract an uncomfortable level of law enforcement attention. DarkSide (Colonial Pipeline), ALPHV/BlackCat (Change Healthcare), and Black Basta (Ascension Health + other factors) succumbed amidst similar conditions.

Momentum and resilience

The number of publicly claimed ransomware victims continued to rise, with 2026 on pace to exceed the 7,307 publicly listed victims recorded in 2025 by approximately 25%. At the same time, the number of active ransomware groups increased, reflecting an expanding and increasingly competitive criminal marketplace. That competition intensified with the emergence of The Gentlemen, whose industry-leading 90% affiliate payout challenged Qilin's position as one of the dominant ransomware-as-a-service (RaaS) operations.

The growth and competition did not go unnoticed by Qilin operators, who responded by investing heavily in their RaaS platform. The group added automated negotiation, legal support, media assistance, and data-leak and data-hosting support.

While the portal was gaining new features, Qilin was delivering massive updates to its ransomware binaries. The major updates optimized cross-platform support, virtualization-focused attacks, affiliate customization, and enterprise-scale deployment. Qilin created a full-service affiliate platform, enabling the group to compete for affiliates on value, as well as the existing 80% to 85% payout percentage. This helped keep Qilin at the top of the ransomware leaderboards, but Qilin had another problem.

German authorities infiltrate Qilin

Qilin didn’t know it yet, but another character stepped into its story sometime in 2024. It seems to have started with what Qilin would call a ‘successful’ ransomware attack against an unnamed German logistics company in September of that year. The company paid approximately $100 million to recover from the attack and keep its data private. While investigating the incident, authorities found forensic artifacts later described as a “small puzzle piece.”

Law enforcement authorities have not provided much information on the investigation. Here’s what we know so far:

• 2024: German authorities launch Operation ALBUS. This is a coordinated international investigation focused on identifying, tracking, arresting, and prosecuting individuals associated with the Qilin ransomware ecosystem.
• Unknown: Investigators recover an undisclosed digital or financial clue while investigating the logistics company that was victimized in September 2024.
• Unknown: Law enforcement agencies use the clue to infiltrate and monitor Qilin. This allowed officials to analyze Qilin infrastructure and follow cryptocurrency flows.
• Unknown: Digital traces and financial analysis link activity to a suspect known as “Snake.”
• Unknown: “Snake” appears to have been identified as Vladimir K. sometime before May 2026.
• Unknown: Investigators determine Vladimir K. works for Qilin “primarily as a developer" and "significantly participated in the profits through ransom extortion."
• Unknown: Investigators infiltrate the computer of Vladimir K.
• Unknown: Authorities identify three additional leading Qilin members. These actors are believed to be in Russia and out of reach of Western authorities.

By this point, German investigators were reportedly monitoring communications in real time and discovered personal correspondence indicating that Vladimir K. was planning a trip to Japan. They shared this information with Japanese authorities, who arrested him at a hotel in Osaka on May 26, 2026.

Extradition to Germany

Now that Japan has a suspect in custody, Germany must establish the legal justification for an extradition. Japan and Germany do not have a bilateral extradition treaty, which (likely) would have provided a pre-negotiated legal framework for the surrender of a suspect.

In the absence of a treaty, German authorities had to submit a formal request under Japan’s existing extradition law. This process requires Germany to provide sufficient evidence that its case against the suspect met all requirements of extradition. An important element here is the principle of dual criminality, which means the suspect’s alleged crime must be a crime in both the requesting country and Japan.

In the case of Vladimir K., German authorities alleged the suspect was involved in computer intrusions, data encryption, and ransom extortion associated with Qilin. Because these acts are crimes under both German and Japanese law, the dual criminality standard was met.

After several months, Germany successfully took custody of Vladimir K. on October 2, 2026. 

The investigation progressed from victim reporting and incident response to attribution, arrest, and ultimately extradition. Today Germany appears to have one core member of Qilin in custody and at least three additional members identified.

What does this mean for Qilin?

The group continued claiming a high number of victims in the months following the arrest, even surging to 163 in August. A threat group of Qilin’s caliber should be able to survive the loss of a single developer. Whether it can survive a massive security leak is another question. German authorities appear to have quite a bit of information about Qilin members and infrastructure, and Vladimir K. may give them more.

Qilin was identified by Japanese law enforcement as the most active threat actor against Japan in 2025. The group claimed responsibility for the high-impact attacks against Nissan and Asahi Breweries. Together these two attacks demonstrated Qilin's ability to disrupt major Japanese enterprises and cause significant financial losses. Working with Germany on this arrest may give Japan access to additional threat intelligence and other resources to support its own efforts against Qilin.

The arrest doesn’t just affect core members. We know Qilin made significant investments in its affiliate network, but did this include portal security? Affiliates must be wondering what authorities were able to track. Financial transactions? Physical locations? Legal identities? What additional arrests will follow?

What does this mean for the public?

Law enforcement agencies can spend months or years correlating victim reports, analyzing infrastructure, tracing cryptocurrency transactions, identifying online personas, and linking them to legal identities. Then they must build the case to support arrests and extradition requests.

Investigators cannot do all of this without victim reports. Each new report is a signal that could correlate with another. What appears to be an isolated ransomware attack may actually be one piece of a much larger investigation spanning multiple victims, countries, and years.

The alleged identification, arrest, and extradition of a core Qilin member serves as a reminder that successful cybercrime investigations rarely begin with a dramatic arrest. They begin with victims reporting what happened. Every report contributes evidence, creates investigative leads, and helps authorities build a clearer picture of the people behind these operations. Without those reports, many of the connections that make cases like this possible would never be made.