The case involves document forgery and fraud. Four people are accused of these crimes, one of whom was – or may still be – an executive at VG Cargo GmbH, an air cargo handling company based at Triwo Airport Hahn in the German state of Rhineland-Palatinate. The case is now being investigated by the district attorney’s office.
According to the responsible public prosecutor, the Russian citizen is alleged to have presented a forged power of attorney, enabling ownership shares in VG Cargo to be transferred to him without the consent of the handling agent’s partner and co-owner, Kirill Kachur. Once accomplished, the entire stake in VG Cargo was then sold to a company registered in Baku, Azerbaijan. Due to the ongoing proceedings, Gerd Deutschler, the senior chief prosecutor in charge at the Bad Kreuznach Public Prosecutor’s Office, did not disclose any names to CargoForwarder Global.
Close ties to the Kremlin
But as research has shown, the person in question is most likely to be Alexander Udodov. A colorful Russian businessman and former son-in-law of Russian prime minister Mikhail Mishustin, a liaison that served as a door opener for excellent connections to the Putin regime. Until March 2023, Udodov was the majority shareholder of Hahn-based VG Cargo. But because of the darkening of the political climate for Putin and his collaborators in the West following Russia’s invasion in Ukraine, Udodov is said to have sold his shares in VG Cargo to the Azerbaijani company Sheer One Investment LLC. Since his former partner, Kirill Kachur, rejected to follow suit and sell his VG Cargo shares (18%), despite a generous financial offer from Udodov (the daily Süddeutsche Zeitung mentions 5 million euros in a remarkable and well documented essay), the forged power of attorney apparently came into play. This led to a rift between the two Russian VG shareholders.
Deliberately forged document, claims Kachur
The power of attorney is said to have been drawn up in Moscow and, according to Kachur, was never signed by him. He claims that at the time he was no longer in Russia because he feared for his personal safety. Consequently, Kachur told the Süddeutsche Zeitung that the signature was forged and that the date of birth listed in the document was not his own, which also points to a forgery.
This is the framework centered on VG Cargo and its once leading figures that the prosecutor’s office is currently trying to unravel.
From an overarching perspective, VG Cargo and companies associated with the ground handling agent appear to still maintain close business ties with Russia, despite Western sanctions on dual use or other critical technical items of high military value flown via third countries and ending up in Russia. However, a case brought by the Koblenz District Attorney’s Office was dismissed due to lack of evidence.
Some dodgy business relations
One of the dubious companies whose business practices and possible ties to Moscow are nebulous is Trans Sib Air Service GmbH, which is also registered at Hahn Airport. According to Hamburg-based data service provider North Data GmbH, which analyzes and documents mandatory financial reports of European companies, Trans Sib has posted continued operating losses since 2018. In fiscal 2024, the deficit amounted to 820,000 euros. The available data does not indicate how these losses are being covered. It is also Russian nationals that are pulling the strings at this company, evidenced by Managing Director Alexander Ivanovich Buzov or his authorized signatory, Vitaly Hartmann.
Another player with business contacts to VG Cargo, which has been liquidated meanwhile, was East West Cargo Service GmbH. The company is alleged to have supplied the Russian military with critical military technology via Hahn Airport, presumably through the handling agent VG Cargo. This was done via Azerbaijan, investigators say, which speak of a “Baku route” as reported by Süddeutsche Zeitung.
The threads all come together in Baku
However, the case has also been dismissed because the evidence proved insufficient. Speaking of Baku: Sheer One Investment LLC is also based there. The company is frequently cited in cross-border financial investigations as a proxy structure designed to obscure the true beneficial ownership of sanctioned assets in the European Union. It has been identified in investigative reports as a corporate vehicle used to facilitate the transfer of foreign assets – such as German logistics firms and Czech real estate – to help Russian businessmen, notably associates of Russian Prime Minister Mikhail Mishustin, evade international sanctions. Sheer One Investment shares office space in the Baku-complex of the Azerbaijani subsidiary of the Russian oil giant Lukoil. In NOV2025, the U.S. imposed sanctions on Lukoil and other Russian oil companies, and the U.S. Treasury described Lukoil in an official statement as a “Kremlin puppet”.
Hahn Airport confirms cyberattack
Credible airline sources informed CargoForwarder Global that the airport had been the target of a hacker attack a few days ago. Upon inquiry, the relevant press office sent us this response:
”A security incident recently occurred in certain parts of our IT systems. The internal processes designed to address such incidents were implemented immediately. The relevant authorities were informed accordingly, and we are in close contact with them.
The incident has not had, and does not have, any impact on airport operations at any time.
Flight operations at Hahn Airport are proceeding without restrictions or disruptions. All flights are being handled according to schedule. Check-in, baggage handling, passenger arrivals and departures, as well as airport services – including parking, dining, and duty-free shopping – are also fully available.
As the relevant authorities are currently investigating the matter, we ask for your understanding that we cannot provide any further details at this time.”
Sincerely, TRIWO Hahn Airport GmbH, Press Office
Upon request, the airport did not comment on whether confidential business or personnel data had been compromised. It also did not provide any information about the suspected perpetrators or any damage caused by the cyberattack.
