Security Researchers Identify Qilin Ransomware Administrator

The Russia-based ransomware-as-a-service group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organisations in the past three months alone, according to cybersecurity firm NCC Group. A series of operational security errors spanning a decade has linked the group’s administrator, known online as "Haise", to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia. Operating since September 2022, Qilin employs a double-extortion model, stealing sensitive data prior to encrypting systems. Malaysian organisations experiencing ransomware incidents can report cases directly to the Cyber999 incident response centre operated by MyCERT.

Key Facts

Who Operates the Qilin Ransomware Syndicate?

Security researchers have linked the Qilin administrator, known online as "Haise", to 36-year-old Aleksey Mikhailovich Yakovtsev of St. Petersburg, Russia. Historical forum registrations, seized forum direct messages, and cross-referenced breach records revealed Yakovtsev holds a master’s degree in computing and information systems and previously operated under multiple cybercrime monikers.

According to a report by cybersecurity firm NCC Group, Qilin has been operating since September 2022 and has become the most industrious ransomware-as-a-service gang. The syndicate incentivises affiliates to deploy ransomware by offering them at least 80 percent of victim extortion payouts. Members follow a double-extortion strategy, exfiltrating confidential corporate records before encrypting infrastructure and threatening public disclosure. Unlike many Russian operations, Qilin collaborates with English-speaking affiliates and has coordinated with criminal groups such as Scattered Spider and RansomHub, according to statements shared on Telegram by its administrator.

Qilin offers affiliates at least 80 percent of ransom payments and has claimed at least 365 victim organisations within a three-month span.

How Did Historical Security Mistakes Expose the Administrator?

Investigative pivots through cybercrime forum databases, breach records, and Telegram identifiers tied Haise back to older identities. When applying to the RAMP forum in June 2022, Haise provided a Telegram username previously used under the moniker "Rjun", which was registered across multiple illicit sites using personal and familial contact information.

Intelligence platform Intel 471 analysed direct messages from RAMP, which was seized by the FBI in January 2026, showing the administrator approved Haise under the Telegram username Alexbigboss44. Historical forum records from Exploit and XSS showed Alexbigboss44 had been utilised in 2020 by the user Rjun. Intelligence firm Flashpoint established that Alexbigboss44 acquired compromised logs and advertising accounts to facilitate fraudulent schemes. Analysis from AI platform IntelHawk and its founder Leo Bogod indicated a progression from fraud in 2018–2019 to complex cybercrime between 2020 and 2023. Further pivots by Intel 471 linked Rjun to registrations on Darkmarket, Verified, and Zloy via the email address [email protected], which identity firm SpyCloud noted once used the password "Rjun132". Constella Intelligence identified this email within leaked records from the Russian state service platform gosuslugi.ru, which suffered a breach exposing over 20 million records in late 2025. That breach identified the email owner as Aleksey Mikhailovich Yakovtsev, born August 18, 1990. Additional pivots on Telegram ID 118329521 linked Yakovtsev to his sister's telephone number, breached Russian flight records between St. Petersburg, Murmansk, and Sochi, and secondary email addresses.

A leaked Russian government database breach in late 2025 tied the forum email address [email protected] directly to Aleksey Mikhailovich Yakovtsev.

What Should You Do?

• Note that no software patch exists for this threat, as Qilin is a cybercrime syndicate rather than a software defect.
• Safeguard corporate networks against illicit access brokers, as affiliates frequently compromise networks using stolen corporate credentials and compromised session logs.
• Maintain isolated, offline backups and monitor data traffic for exfiltration to mitigate exposure under double-extortion schemes.
• Report any active ransomware intrusions or extortion demands in Malaysia to the Cyber999 Computer Emergency Response Team under MyCERT.

Common Questions

What is the Qilin ransomware group?

Qilin is a Russia-based ransomware-as-a-service affiliate program active since September 2022. It operates a double-extortion scheme where affiliates exfiltrate corporate files prior to system encryption, offering participants at least 80 percent of extortion proceeds. It has claimed at least 365 victim organisations across a recent three-month period.

Who is accused of running the Qilin operation?

Cybersecurity researchers have linked the Qilin administrator, known by the handle "Haise", to 36-year-old Aleksey Mikhailovich Yakovtsev of St. Petersburg, Russia. Yakovtsev holds a master’s degree in computing and information systems and previously operated under the handles "Rjun" and "Alexbigboss44" across various illicit cyber forums.

How was the administrator's identity uncovered?

Deanonymisation resulted from operational security errors across multiple forums and services. Researchers traced usernames across RAMP, Exploit, and XSS to an email address registered on several platforms. This email was matched to Yakovtsev within leaked records from the breached Russian state portal gosuslugi.ru alongside associated travel records.

Sources and Methodology

This dispatch is based entirely on reporting published by Krebs on Security on Wednesday 11th of November 2026. No independent review, verification, or consultation of external documents, vendor advisories, or primary breach repositories was conducted for this report.