Who Runs the Ransomware Group Qilin? – Krebs on Safety

The cybercrime group Qilin has emerged because the world’s most energetic ransomware associates program, claiming at the least 365 sufferer organizations previously three months alone. However even high Russian hackers make operational safety errors, and the administrator of Qilin has made just a few key missteps over the past decade that each one level to a 36-year-old man dwelling in St. Petersburg, Russia.

Working since September 2022, the Russia-based ransomware group Qilin is the presently probably the most industrious ransomware-as-a-service gang, in keeping with a report (PDF) this month by the cybersecurity agency NCC Group (KrebsOnSecurity profiled the administrator of the second most energetic ransomware group — The Gents — in June).

The Qilin ransomware administrator “Haise” promoting his associates program on the cybercrime discussion board RAMP. Picture: Ke-la.com.

Qilin attracts associates to hack into corporations and deploy ransomware by providing them at the least 80 p.c of any extortion quantity paid by victims. Its members apply the “double extortion” mannequin, stealing delicate knowledge earlier than encrypting methods and threatening to publish the information on-line. Not like most ransomware partnerships primarily based out of Russia, Qilin is comfortable to group with English-speaking associates, and its chief has shared on Telegram that they’ve labored with cybercrime teams like Scattered Spider and RansomHub.

The pinnacle of Qilin goes by the deal with “Haise,” however they weren’t at all times identified by this nickname. It’s not unusual for cybercriminals to alter their deal with periodically as an operational safety (opsec) measure. Doing so is mostly a wise transfer, as a result of it helps to sever one’s ties to older identities that will not have been as cautious on primary opsec, similar to separating their actual life identification from their cybercrime actions. However even these cautious criminals will typically must reference their previous monikers when making use of for membership at a brand new discussion board. And boards ultimately get hacked or seized. That’s exactly what occurred with Haise.

The cyber intelligence platform Intel 471 data that in June 2022, Haise utilized for membership to RAMP, a closely-guarded Russian cybercrime discussion board that was created as a haven for ransomware affiliate packages. Intel 471 has listed direct messages from RAMP (the discussion board was seized by the FBI in January 2026), and people missives present the RAMP administrator authorised Haise’s utility, referring to this consumer as Haise and by their Telegram username: Alexbigboss44.

Looking Intel 471 for Alexbigboss44 reveals this was the Telegram account title shared by the consumer Rjun on the Russian cybercrime boards Exploit and XSS two years earlier in 2020. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal boards and Telegram channels, primarily targeted on the illicit commerce of visitors, logs, and company entry [full disclosure: Flashpoint is an advertiser on this blog].

The Qilin administrator as soon as used the nickname “Rjun” on a number of boards, and shared their Telegram deal with as “Alexbigboss44.” Picture: Ke-la.com.

Flashpoint says this consumer was engaged in high-volume acquisition of Fb logs and Google Advertisements accounts to facilitate fraudulent promoting and playing schemes, and that they functioned as a dealer and operator — managing a community of traffickers and buying compromised knowledge to gas their operations.

The hyperlink between the Qilin administrator Haise and the a lot older Rjun and Alexbigboss44 accounts was shared privately earlier this month by IntelHawk, which describes itself as an AI-based platform able to de-anonymizing menace actors primarily based on historic usernames, stylometry and different indicators.

IntelHawk founder and chief expertise officer Leo Bogod mentioned an evaluation of those identities exhibits a development from novice arbitrageur and bank card fraudster in 2018–2019 to a extra skilled participant and organizer of advanced cybercrime-related actions in 2020–2023, with growing consideration to malware, botnets, and cost infrastructure.

The place does this connection between these menace actor identities lead? Intel 471 finds that by the point Alexbigboss44 was making use of for membership to RAMP, Rjun was already a longtime member of a number of different Russian crime boards, together with Darkmarket, Verified, and Zloy. Intel 471 says Rjun signed up in any respect of those websites with the e-mail handle mail-30a@mail.ru.

The identification menace safety agency Spycloud discovered the e-mail handle mail-30a@mail.ru at one time used the password “Rjun132” [Spycloud is also an advertiser on this blog]. A seek for that electronic mail on the breach monitoring service Constella Intelligence exhibits that it appeared in data maintained by gosuslugi.ru, the official digital platform for state and municipal providers within the Russian Federation.

Gosuslugi was breached in late 2025, reportedly exposing greater than 20 million data with full names, beginning dates, and cellular numbers. In keeping with the leaked Gosuslugi data (through Constella), the handle mail-30a@mail.ru belongs to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia.

Flashpoint finds Haise has lengthy used a Telegram account with the consumer ID 118329521, recording greater than 5,000 messages from this consumer since 2018. Data from Russia’s schooling watchdog Rosobrnadzor reveal that Mr. Yakovtsev went to grade college in Murmansk and that he holds a grasp’s diploma in computing and knowledge methods.

A search on this Telegram ID in Constella exhibits it’s linked to the Russian cellphone quantity +79602347275. Pivoting on that cellphone quantity in Constella reveals it’s related to the e-mail addresses aleksey1990yakov@mail.ru and rjun123321@mail.ru. IntelHawk finds that +79602347275 belongs to Yakovtsev’s organic sister, and that Aleksey typically used his sister’s electronic mail handle when registering at totally different web sites.

That cellphone quantity seems on a number of airline flight data at Russian journey businesses which have skilled a knowledge breach in recent times, and people data present Aleksey Yakovtsev, born August 18, 1990, flew between St. Petersburg and Murmansk at the least thrice between 2013 and 2014.

More moderen flight data present that whereas Mr. Yakovtsev has not traveled by aircraft exterior of Russia, he does fly steadily between Saint Petersburg and Sochi. Usually referred to as the “Russian Riviera,” Sochi is Russia’s largest resort metropolis, located alongside the coast of the Black Sea and about 1,200 miles south of Saint Petersburg by aircraft.

Makes an attempt to achieve Mr. Yakovtsev through electronic mail and cellphone had been unsuccessful.

Additional studying: GangExposed, an nameless Twitter/X account that has a historical past of efficiently deanonymizing suspected ransomware actors, reached related conclusions about Haise’s real-life identification, crediting IntelHawk’s platform for serving to to attach the dots.