NRW Interior Minister Herbert Reul announced on Oct 7 that the state criminal police (LKA NRW) and the ZAC Cybercrime unit had caught "one of the leading figures" of the Qilin ransomware operation, after infiltrating and covertly watching the group for months. The suspect, a 28-year-old Russian named in German media as Vladimir K. (alias "snake"), was arrested in Japan in May. Der Spiegel puts it on May 26, in Osaka. He was extradited to Germany in early October and is in pre-trial detention. Japan's National Police Agency confirmed on Oct 8 that it detained the suspect on a German warrant under its extradition law and handed him over. German authorities say Qilin has hit nearly 4,000 organizations since 2024. Per the German warrant cited by the BBC, the suspect is accused over a September 2024 attack on a German logistics company with a demand of about $160,000. On Oct 16 the BBC reported that German detectives are now also including the June 2024 attack on London pathology provider Synnovis in the investigation. That attack disrupted London hospitals and was later linked to a patient's death.

Why it matters: it's a rare arrest of an alleged ransomware developer rather than an affiliate, made possible by a holiday trip and an extradition from a country with no bilateral treaty with Germany. Qilin itself is still active. Unit 42 lists it among the crews exploiting PAN-OS CVE-2026-0257 this month.