German Logistics Firm: Alleged Core Qilin Ransomware Member Extradited from Japan

German prosecutors now hold a 28-year-old Russian national accused of being a core member of the Qilin ransomware-as-a-service operation. Japanese investigators arrested him in Osaka in May 2026 on a German warrant, and Japan's National Police Agency has confirmed his extradition to Germany. The case covers one intrusion: an attack in September 2024 on an unnamed German logistics company. Barracuda describes the investigation behind it as 21 months long and spanning several jurisdictions. Reports disagree sharply on the money involved. SecurityWeek says the company was extorted for more than $160,000 in cryptocurrency, and The Asahi Shimbun, citing sources, gives $165,000 (26 million yen) in bitcoin. Barracuda's blog, the only source for the "$100 million" headline figure, says the company paid about $100 million to recover from the attack and keep its data private. That claim is roughly 600 times higher than the other reports, and no law-enforcement or outlet source we reviewed backs it up.

What Happened

• The intrusion (September 2024): According to The Asahi Shimbun's sources, the suspect accessed systems at a German logistics company, stole and encrypted data, and threatened to publish it unless a bitcoin ransom was paid. SecurityWeek reports the same timeline and target.
• The warrant: Germany obtained an arrest warrant over the incident. The Record reports that the charges relate to a ransomware attack on a German company. The Asahi Shimbun says he is being investigated for extortion, and SecurityWeek says he faces hacking charges.
• The arrest (May 2026): The Record, citing Nippon, reports that Japanese officials learned he planned a holiday in Japan and arrested him at an Osaka hotel. The NPA statement quoted by BleepingComputer says the Ministry of Justice and the Tokyo High Public Prosecutors Office worked with Germany to obtain a provisional detention warrant under Japan's Extradition Law. The Asahi Shimbun says the Tokyo High Court issued that warrant.
• The extradition: SecurityWeek, The Asahi Shimbun and Barracuda all date the handover to October 2. The Record, citing Nippon, says he was sent to Germany in June. The October 2 date has more support, but the conflict has not been resolved publicly.
• Identity: Barracuda names him as "Vladimir K." Japanese authorities have not released his name, according to The Record. German authorities did not respond to The Record's request for comment.
• Alleged role: The Asahi Shimbun's sources say he built systems used in Qilin attacks. Investigators describe Qilin as several operational units that carry out attacks under the direction of core members such as the suspect, with ransom proceeds passed up to leadership. Authorities say they confirmed he received part of the proceeds in this case. Barracuda reports that three other leading Qilin members are believed to be in Russia, out of reach of Western law enforcement.

What Was Taken

No public source names the victim or says what kind of data, or how much, was stolen from the German logistics company. The Asahi Shimbun says only that data was "illegally obtained and encrypted" and used as leverage under a threat to publish. The financial figures are where the sources disagree:

The two outlet and press figures agree with each other, and $165,000 converts cleanly to 26 million yen. The $100 million figure appears only in a vendor blog. Unless German prosecutors confirm it, it should be treated as unverified and possibly an error.

For context on Qilin's wider impact, reporting on the group's 2025 attack on Asahi Group puts the exposure at 1.5 million people (BleepingComputer) or roughly 2 million (SecurityWeek).

Why It Matters

• A rare arrest of a core member: Ransomware arrests usually catch affiliates or money launderers. If the allegations hold, this case reaches a developer or infrastructure builder in the most active RaaS operation of 2025. Its scale is reported as more than 2,350 known organizations in 62 countries (BleepingComputer) or 400 leak-site victims in 2025 alone (SecurityWeek).
• Travel is the weak point: Russian-based operators are effectively out of reach at home. This arrest happened because investigators knew about a holiday trip ahead of time and had an extradition framework ready in a third country. That is the same approach used against earlier ransomware suspects, and it works.
• One victim report can be enough: Barracuda credits victim reporting, forensic evidence and cross-border intelligence sharing for linking the attack to a real person. A single reported case of about $165,000 led to a suspected core operator. Victims who report and keep forensic evidence matter well beyond their own incident.
• Qilin is not stopped: One suspect in custody will not disrupt an operation built on many affiliates. Qilin has kept up a high pace: Die Linke in April 2026 (The Record), exploitation of the Check Point flaw CVE-2026-50751 in June, and the US ATF in August (SecurityWeek).

The Attack Technique

Public reporting does not say how the attackers first got into the German logistics company. Here is what is documented about Qilin's tradecraft more broadly:

• Double extortion: Data is stolen before encryption, then publication is threatened (BleepingComputer, The Asahi Shimbun).
• Edge-device exploitation: SecurityWeek reports Qilin exploited CVE-2026-50751, a critical authentication bypass in Check Point VPN and firewall products, in June 2026.
• Affiliate tradecraft: Microsoft Threat Intelligence tracks Storm-2570, an affiliate that has deployed Qilin along with DragonForce, Anubis and BERT payloads. Its intrusions follow a consistent pattern: remote access tooling, credential access, lateral movement, tampering with security tools, and exfiltration to cloud storage. Microsoft's point is that defenders should track behavior, because affiliates change ransomware payloads. No source links Storm-2570 to the 2024 German attack or to this suspect.

What Organizations Should Do

1. Patch edge devices urgently. Apply Check Point's fixes for CVE-2026-50751, and treat any internet-facing VPN or firewall with an authentication bypass flaw as a likely way in for Qilin.
2. Hunt for behavior, not payloads. Use Microsoft's Storm-2570 guidance and hunting queries to look for unauthorized remote management tools, credential dumping, and attempts to disable security tooling. These appear before encryption, whichever ransomware strain follows.
3. Monitor for bulk exfiltration to cloud storage. Alert on large outbound transfers to file-sharing and cloud sync services from servers that would not normally make them. Under double extortion, the data theft is what gives the attackers leverage.
4. Harden remote access. Require phishing-resistant MFA on VPN and remote access, remove dormant accounts, and restrict who can use administrative remote tools.
5. Keep tested offline backups. Logistics and other operations-heavy businesses should rehearse restoring order processing and shipping systems, since that is where Asahi's recovery took weeks.
6. Report and preserve evidence. Notify national law enforcement promptly and keep logs and forensic images. This case shows that a single well-documented report can lead to an arrest.

Sources: 21 months, $100 million, one Qilin suspect in custody Barracuda Ne... | Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft... | Germany arrests alleged core Qilin ransomware member after extradition | Japan confirms arrest of Russian Qilin operative, extradition to Ge... | Latvia arrests suspected hacker for electronics repair company brea... | Bengaluru: Private IP service company files bitcoin extortion bid c... | Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany -... | Japan collars fugitive suspect of ransomware syndicate Qilin The A...