Loading signal...
Signal
Submitted
Apr 28, 2026, 13:45 UTC
German authorities identified Nikolay K. in Russia as a core suspect in the REvil ransomware group responsible for high-profile cyber extortion, but capture is unlikely due to his location and lack of extradition.
German prosecutors, supported by the Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police (LKA), have identified Nikolay K., resident near a southern Russian city, as a key figure in the REvil ransomware group involved in extorting companies and public institutions. Using ransomware, REvil encrypts corporate networks and demands high ransoms, with the largest known demand reaching $70 million. Nikolay K. has reportedly used ransom funds to support a lavish lifestyle including luxury watches, cars, and vacations. Investigators traced Bitcoin payments worth nearly 400,000 euros linked to him, notably from a 2019 ransomware attack on the Stuttgart State Theaters that disrupted email communications and forced paper ticket replacements. Although an arrest warrant exists, extradition is improbable as he remains in Russia; a recent holiday in Turkey did not lead to detention. The German government and US officials have engaged Russia diplomatically over ransomware threats originating there. The continuous investigations aim to disrupt these cybercriminal networks and improve cyber defense capabilities.
Confidence: High
The article explicitly identifies a suspect in Russia connected to ransomware attacks targeting German entities and provides detailed investigative and operational context, confirming aggressive cybercriminal activity.
Source URL
https://tagesschau.de/investigativ/br-recherche/ransomware-revil-101.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "1c917f08-7193-4abe-aea6-f8075499137a",
"url": "https://tagesschau.de/investigativ/br-recherche/ransomware-revil-101.html",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Germany",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"ransomware",
"REvil",
"Bitcoin",
"cybercrime",
"cyberattacks",
"Germany",
"Russia",
"Baden-Württemberg",
"law enforcement",
"Bitcoin payments",
"Stuttgart State Theaters",
"LKA Baden-Württemberg",
"BKA"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "Ransomware Attacks: Suspect Identified in Russia",
"description": "German prosecutors have identified a suspect named Nikolay K., believed to be a core member of the REvil ransomware group operating from Russia. Nikolay K. allegedly financed a luxurious lifestyle with ransom payments extorted from companies and governmental bodies, including a ransomware attack on the Stuttgart State Theaters disrupting their email for five days. Investigations traced Bitcoin payments linked to him, with payments exceeding 400,000 euros potentially derived from ransomware extortion. Despite a prepared arrest warrant, capture remains unlikely as he resides in Russia and did not face extradition during a recent trip to Turkey. German authorities continue to investigate the cybercriminal network, confirming the connection between REvil and its predecessor Gandcrab. High-level diplomatic discussions between the US and Russia have pressed for action against ransomware groups operating from Russia. The German Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police Office (LKA) are leading the investigations.",
"summary_short": "German authorities identified Nikolay K. in Russia as a core suspect in the REvil ransomware group responsible for high-profile cyber extortion, but capture is unlikely due to his location and lack of extradition.",
"summary_extended": "German prosecutors, supported by the Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police (LKA), have identified Nikolay K., resident near a southern Russian city, as a key figure in the REvil ransomware group involved in extorting companies and public institutions. Using ransomware, REvil encrypts corporate networks and demands high ransoms, with the largest known demand reaching $70 million. Nikolay K. has reportedly used ransom funds to support a lavish lifestyle including luxury watches, cars, and vacations. Investigators traced Bitcoin payments worth nearly 400,000 euros linked to him, notably from a 2019 ransomware attack on the Stuttgart State Theaters that disrupted email communications and forced paper ticket replacements. Although an arrest warrant exists, extradition is improbable as he remains in Russia; a recent holiday in Turkey did not lead to detention. The German government and US officials have engaged Russia diplomatically over ransomware threats originating there. The continuous investigations aim to disrupt these cybercriminal networks and improve cyber defense capabilities.",
"actor_primary": "Nikolay K.",
"target_primary": null,
"location_text": "Baden-Württemberg, near Stuttgart, Germany",
"location_region": "Baden-Württemberg",
"location_coordinates_lat": 48.7758,
"location_coordinates_lon": 9.1829,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly identifies a suspect in Russia connected to ransomware attacks targeting German entities and provides detailed investigative and operational context, confirming aggressive cybercriminal activity.",
"event_time_utc": "2021-10-28T07:35:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-28T13:45:00.487Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Oct 28, 2021, 07:35 UTC
Event time confidence
exact
Location
Baden-Württemberg, near Stuttgart, Germany
Region
Baden-Württemberg
Primary actor
Nikolay K.
Country
Germany
Countries
Germany
Tags
ransomware, REvil, Bitcoin, cybercrime, cyberattacks, Germany, Russia, Baden-Württemberg, law enforcement, Bitcoin payments, Stuttgart State Theaters, LKA Baden-Württemberg, BKA
Nodes
Node 2: 5th Column
Signal
Submitted
Apr 28, 2026, 13:45 UTC
German authorities identified Nikolay K. in Russia as a core suspect in the REvil ransomware group responsible for high-profile cyber extortion, but capture is unlikely due to his location and lack of extradition.
German prosecutors, supported by the Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police (LKA), have identified Nikolay K., resident near a southern Russian city, as a key figure in the REvil ransomware group involved in extorting companies and public institutions. Using ransomware, REvil encrypts corporate networks and demands high ransoms, with the largest known demand reaching $70 million. Nikolay K. has reportedly used ransom funds to support a lavish lifestyle including luxury watches, cars, and vacations. Investigators traced Bitcoin payments worth nearly 400,000 euros linked to him, notably from a 2019 ransomware attack on the Stuttgart State Theaters that disrupted email communications and forced paper ticket replacements. Although an arrest warrant exists, extradition is improbable as he remains in Russia; a recent holiday in Turkey did not lead to detention. The German government and US officials have engaged Russia diplomatically over ransomware threats originating there. The continuous investigations aim to disrupt these cybercriminal networks and improve cyber defense capabilities.
Confidence: High
The article explicitly identifies a suspect in Russia connected to ransomware attacks targeting German entities and provides detailed investigative and operational context, confirming aggressive cybercriminal activity.
Source URL
https://tagesschau.de/investigativ/br-recherche/ransomware-revil-101.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "1c917f08-7193-4abe-aea6-f8075499137a",
"url": "https://tagesschau.de/investigativ/br-recherche/ransomware-revil-101.html",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Germany",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"ransomware",
"REvil",
"Bitcoin",
"cybercrime",
"cyberattacks",
"Germany",
"Russia",
"Baden-Württemberg",
"law enforcement",
"Bitcoin payments",
"Stuttgart State Theaters",
"LKA Baden-Württemberg",
"BKA"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "Ransomware Attacks: Suspect Identified in Russia",
"description": "German prosecutors have identified a suspect named Nikolay K., believed to be a core member of the REvil ransomware group operating from Russia. Nikolay K. allegedly financed a luxurious lifestyle with ransom payments extorted from companies and governmental bodies, including a ransomware attack on the Stuttgart State Theaters disrupting their email for five days. Investigations traced Bitcoin payments linked to him, with payments exceeding 400,000 euros potentially derived from ransomware extortion. Despite a prepared arrest warrant, capture remains unlikely as he resides in Russia and did not face extradition during a recent trip to Turkey. German authorities continue to investigate the cybercriminal network, confirming the connection between REvil and its predecessor Gandcrab. High-level diplomatic discussions between the US and Russia have pressed for action against ransomware groups operating from Russia. The German Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police Office (LKA) are leading the investigations.",
"summary_short": "German authorities identified Nikolay K. in Russia as a core suspect in the REvil ransomware group responsible for high-profile cyber extortion, but capture is unlikely due to his location and lack of extradition.",
"summary_extended": "German prosecutors, supported by the Federal Criminal Police (BKA) and the Baden-Württemberg State Criminal Police (LKA), have identified Nikolay K., resident near a southern Russian city, as a key figure in the REvil ransomware group involved in extorting companies and public institutions. Using ransomware, REvil encrypts corporate networks and demands high ransoms, with the largest known demand reaching $70 million. Nikolay K. has reportedly used ransom funds to support a lavish lifestyle including luxury watches, cars, and vacations. Investigators traced Bitcoin payments worth nearly 400,000 euros linked to him, notably from a 2019 ransomware attack on the Stuttgart State Theaters that disrupted email communications and forced paper ticket replacements. Although an arrest warrant exists, extradition is improbable as he remains in Russia; a recent holiday in Turkey did not lead to detention. The German government and US officials have engaged Russia diplomatically over ransomware threats originating there. The continuous investigations aim to disrupt these cybercriminal networks and improve cyber defense capabilities.",
"actor_primary": "Nikolay K.",
"target_primary": null,
"location_text": "Baden-Württemberg, near Stuttgart, Germany",
"location_region": "Baden-Württemberg",
"location_coordinates_lat": 48.7758,
"location_coordinates_lon": 9.1829,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly identifies a suspect in Russia connected to ransomware attacks targeting German entities and provides detailed investigative and operational context, confirming aggressive cybercriminal activity.",
"event_time_utc": "2021-10-28T07:35:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-28T13:45:00.487Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Oct 28, 2021, 07:35 UTC
Event time confidence
exact
Location
Baden-Württemberg, near Stuttgart, Germany
Region
Baden-Württemberg
Primary actor
Nikolay K.
Country
Germany
Countries
Germany
Tags
ransomware, REvil, Bitcoin, cybercrime, cyberattacks, Germany, Russia, Baden-Württemberg, law enforcement, Bitcoin payments, Stuttgart State Theaters, LKA Baden-Württemberg, BKA
Nodes
Node 2: 5th Column