ThreatPaper

#extradition

4 cases

A 28-year-old Russian, described as a Qilin core member, was arrested in Osaka in May 2026 and handed to Germany on 2 October over a September 2024 attack on a German logistics firm and a ~¥26M Bitcoin ransom. The case rests on investigative sources, not a published charging document.

Ransomware

A Conti affiliate who coded a loader and intruded on twelve victims got 48 months in Nashville on 10 September 2026. The judgment credits custody since his July 2023 arrest in Cork, leaving about ten months. Plea agreement and docket analysed.

RansomwareExtortion & Blackmail

A Russian national extradited from Cyprus faces trial over a 2016–17 campaign that used 225 fake accounts on a Santa Clara freelance platform to send Excel macros dropping the TeamViewer-abusing TVRAT. The unsealed indictment gives numbers the press release rounded away.

MalwareSocial EngineeringFinancial Fraud

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

Financial FraudSocial EngineeringIdentity Theft