Identifying the Leader Behind the Qilin Ransomware Group

12 November 2026 3 min read هدهد تك | Hudhud Tech

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months. Investigations indicate that the administrator of Qilin is a 36-year-old man from St. Petersburg, Russia.

Operating since September 2022, Qilin is currently the most industrious ransomware-as-a-service gang, according to a report by the cybersecurity firm NCC Group. Qilin attracts affiliates by offering them at least 80 percent of any extortion amount paid by victims, employing a “double extortion” model that involves stealing sensitive data before encrypting systems and threatening to publish the files online. Unlike many Russian ransomware groups, Qilin collaborates with English-speaking affiliates and has worked with groups like Scattered Spider and RansomHub.

The head of Qilin, known by the handle “Haise,” has made several operational security mistakes that have led investigators to his identity. Cybercriminals often change their handles to maintain anonymity, but Haise’s past references have surfaced during membership applications to new forums. In June 2022, Haise applied for membership to RAMP, a Russian cybercrime forum. The RAMP administrator approved his application, identifying him as Haise and linking him to the Telegram username Alexbigboss44.

Research from Intel 471 reveals that Alexbigboss44 was previously associated with the user Rjun on Russian cybercrime forums Exploit and XSS in 2020. Flashpoint indicates that this user was involved in acquiring Facebook logs and Google Ads accounts for fraudulent schemes, acting as a broker and operator in cybercriminal activities.

IntelHawk has connected Haise to the earlier accounts of Rjun and Alexbigboss44, showing a progression in his cybercrime activities from 2018–2019 as a novice to a more experienced organizer by 2023. By the time he applied for RAMP, Rjun was already a member of several other crime forums, using the email address mail-30a@mail.ru.

Identity threat protection firm Spycloud found that this email was previously linked to the password “Rjun132.” A search revealed that this email appeared in records from gosuslugi.ru, the Russian Federation’s official digital platform, which suffered a breach in late 2025, exposing over 20 million records. The leaked data identified the email as belonging to Aleksey Mikhailovich Yakovtsev, 36, from St. Petersburg.

Flashpoint notes that Haise has used a Telegram account with user ID 118329521, with over 5,000 messages recorded since 2018. Records from Russia’s education watchdog indicate that Yakovtsev holds a master’s degree in computing and information systems. A search on this Telegram ID links it to the phone number +79602347275, associated with Yakovtsev’s sister, suggesting he often used her email for registrations.

This phone number appears in airline flight records showing Yakovtsev flying between St. Petersburg and Murmansk multiple times in 2013 and 2014. Recent records indicate he frequently travels between Saint Petersburg and Sochi but has not flown outside Russia.

Attempts to contact Yakovtsev via email and phone were unsuccessful. An anonymous Twitter/X account, Gang Exposed, has also reached similar conclusions about Haise’s identity, crediting IntelHawk’s platform for its findings.