Qilin Ransomware Leader Identified: Russian Cybercriminal Exposed Through OPSEC Failures
The Qilin ransomware group has claimed at least 365 victim organisations in just three months, making it the world’s most active ransomware affiliate program. A detailed investigation has now traced the group’s administrator to a 36-year-old man living in St. Petersburg, Russia, after a series of operational security mistakes spanning nearly a decade.
Original reporting by Brian Krebs: Who Runs the Ransomware Group Qilin? — KrebsOnSecurity, November 14, 2026
What Happened: Unmasking the Qilin Administrator
According to a report by cybersecurity firm NCC Group, Qilin has emerged as the most industrious ransomware-as-a-service operation currently active. The group has been operating since September 2022 and attracts affiliates by offering them at least 80 percent of any extortion payments collected from victims.
The investigation revealed that the Qilin leader, known as “Haise,” made critical operational security errors that allowed researchers to connect multiple online identities. Cyber intelligence platform Intel 471 documented that in June 2022, Haise applied for membership to RAMP, a closely-guarded Russian cybercrime forum created specifically for ransomware affiliate programs.
The RAMP forum was seized by the FBI in January 2026, exposing direct messages that linked Haise to an earlier Telegram username: Alexbigboss44. This connection proved crucial in unravelling the administrator’s true identity.
How Did Investigators Trace the Qilin Ransomware Leader?
The identity trail followed a clear progression through multiple platforms and databases:
- Intel 471 found that Alexbigboss44 was previously used by the account “Rjun” on Russian cybercrime forums Exploit and XSS in 2020
- Flashpoint identified Alexbigboss44 as a prolific participant in cybercriminal forums, primarily focused on traffic, logs, and corporate access trading
- IntelHawk, an AI-based de-anonymisation platform, confirmed the link between Haise and the older Rjun and Alexbigboss44 accounts
According to IntelHawk founder and CTO Leo Bogod, analysis showed a progression from novice credit card fraudster in 2018–2019 to an organiser of complex cybercrime operations by 2020–2023, with increasing focus on malware, botnets, and payment infrastructure.
The Email Trail That Exposed Everything
Intel 471 discovered that Rjun registered at multiple Russian crime forums—including Darkmarket, Verified, and Zloy—using the email address mail-30a@mail.ru. Identity protection firm Spycloud found this email had used the password “Rjun132.”
Breach tracking service Constella Intelligence found this email appeared in records from gosuslugi.ru, Russia’s official digital platform for government services. The Gosuslugi breach in late 2025 reportedly exposed more than 20 million records containing full names, birth dates, and mobile numbers.
Who Is Behind the Qilin Ransomware Group?
According to the leaked Gosuslugi records via Constella, the email mail-30a@mail.ru belongs to Aleksey Mikhailovich Yakovtsev, a 36-year-old from St. Petersburg, Russia. Additional records from Russia’s education watchdog Rosobrnadzor revealed that Yakovtsev attended school in Murmansk and holds a master’s degree in computing and information systems.
Flashpoint documented that Haise has used a Telegram account (user ID 118329521) recording more than 5,000 messages since 2018. This Telegram ID was linked to the Russian phone number +79602347275, which IntelHawk found belongs to Yakovtsev’s biological sister—a number Aleksey frequently used when registering on various websites.
Flight records from Russian travel agencies that experienced data breaches confirmed that Aleksey Yakovtsev, born August 18, 1990, travelled between St. Petersburg and Murmansk at least three times between 2013 and 2014.
Understanding Qilin’s Ransomware Operations
The Qilin ransomware group operates using the “double extortion” model, which involves:
- Stealing sensitive data from victim organisations
- Encrypting systems to disrupt operations
- Threatening to publish stolen files online if ransom demands aren’t met
Unlike most Russia-based ransomware operations, Qilin actively collaborates with English-speaking affiliates. The group’s leader has shared on Telegram that they’ve worked with notorious cybercrime groups including Scattered Spider and RansomHub.
If your organisation is concerned about ransomware threats, consider engaging vulnerability management services to identify and address potential entry points before attackers can exploit them.
Frequently Asked Questions
What is the Qilin ransomware group?
Qilin is a Russia-based ransomware-as-a-service operation that has been active since September 2022. It is currently the world’s most active ransomware affiliate program, having claimed at least 365 victim organisations in the past three months alone. The group offers affiliates 80 percent of extortion payments and uses double extortion tactics.
How do ransomware operators get identified?
Cybercriminals are often identified through operational security failures. In this case, investigators connected multiple usernames across different forums, traced email addresses through data breaches, and leveraged leaked government records. Even when criminals change their handles, they sometimes reference old identities when applying to new forums.
How can Australian businesses protect against ransomware attacks?
Organisations should implement robust backup strategies, maintain up-to-date security patches, deploy endpoint detection and response solutions, and train employees to recognise phishing attempts. Regular security assessments can help identify vulnerabilities before attackers exploit them. To assess your organisation’s ransomware readiness, speak with our security team.
Key Takeaways
- The Qilin ransomware group has become the world’s most active ransomware operation with 365+ victims in three months
- The group’s administrator “Haise” has been linked to Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian national with a master’s degree in computing
- Operational security failures across multiple forums and data breaches enabled the identification
- Qilin uniquely collaborates with English-speaking cybercriminals including Scattered Spider and RansomHub
- The FBI’s seizure of the RAMP forum in January 2026 provided crucial evidence
Conclusion
This investigation into the Qilin ransomware group demonstrates that even sophisticated cybercriminals can be identified through persistent operational security failures. The exposure of Aleksey Yakovtsev highlights how historical data breaches and forum seizures can unravel carefully constructed anonymous identities. For Australian organisations, this case underscores both the organised nature of modern ransomware operations and the importance of maintaining robust cyber defences against these increasingly industrious threat actors.