The Qilin ransomware group has emerged as a significant player in the cybercrime landscape, claiming at least 365 victims in just three months, according to a recent report by cybersecurity firm NCC Group. This surge in activity highlights Qilin’s position as the most active ransomware-as-a-service (RaaS) operation currently operating, with its activities traced back to a 36-year-old individual in St. Petersburg, Russia.
Since its inception in September 2022, Qilin has attracted affiliates by offering them a lucrative deal—at least 80% of any extortion payment made by victims. The group employs a “double extortion” strategy, where they not only encrypt victims’ data but also steal sensitive information, threatening to publish it online if the ransom is not paid. Unlike many Russian ransomware groups, Qilin is open to collaborating with English-speaking affiliates, broadening its operational reach. The group’s leader, known by the alias “Haise,” has indicated on Telegram that they have partnered with other cybercrime entities, including Scattered Spider and RansomHub.
Operational Security Missteps
Despite its success, Qilin’s administrator has made notable operational security errors over the years. Haise, who has changed aliases multiple times as a precautionary measure, has left a trail of digital footprints that have led researchers to his real identity. In June 2022, he applied for membership on RAMP, a prominent Russian cybercrime forum, where he was approved under the username Haise and the Telegram handle Alexbigboss44. This connection was revealed through communications indexed by Intel 471, a cyber intelligence platform.
Further investigation into the alias Alexbigboss44 shows that it was previously associated with a user named Rjun on various cybercrime forums, where he was involved in acquiring compromised data for fraudulent activities. This history indicates a progression from a novice fraudster to a more sophisticated cybercriminal, managing complex operations involving malware and botnets.
Linking Identities and Real-World Connections
Intel 471’s analysis has established a connection between Haise and earlier identities, suggesting that the individual behind Qilin has been active in the cybercrime scene since at least 2018. The email address associated with Rjun, mail-30a@mail.ru, was found in records from gosuslugi.ru, a Russian government service platform that suffered a data breach in late 2025, exposing over 20 million records. This breach linked the email to Aleksey Mikhailovich Yakovtsev, the suspected administrator of Qilin.
Yakovtsev’s digital footprint extends to his Telegram account, which has been active since 2018, and is linked to a phone number associated with his family. Flight records indicate that he frequently travels within Russia, particularly between St. Petersburg and Sochi, further corroborating his identity.
Attempts to contact Yakovtsev via email and phone have been unsuccessful, but the investigation into his activities continues. The findings from IntelHawk and other cyber intelligence platforms underscore the importance of operational security in the cybercrime world, where even experienced criminals can leave traces that lead to their identification.
As Qilin continues to operate and expand its affiliate network, the implications for organizations worldwide are significant. The group’s aggressive tactics and willingness to collaborate with various cybercriminals make it a formidable threat in the ransomware landscape.
For further insights into the Qilin ransomware group and its operations, see the detailed analysis by Krebs on Security here.
