Investigation Claims to Identify Qilin Ransomware Administrator Haise

GangExposed has published an investigation claiming to identify the Russian national behind Haise, the public-facing administrator persona of Qilin’s ransomware-as-a-service affiliate program. As reported by SOCRadar, the investigation links forum profiles, Telegram activity and leaked Russian databases. The identification remains unverified, with no independent confirmation or law-enforcement validation. German authorities arrested a suspected leading Qilin member in October 2026 following extradition from Japan, but no public evidence connects that suspect to Haise.

Qilin remains active despite the arrest and declining leak-site activity. SOCRadar reports more than 2,350 known victim organizations across 62 countries, underscoring the operation’s reach. The alleged identification does not establish that Qilin’s infrastructure or affiliate network has been disrupted. Defenders should continue prioritizing multifactor authentication for remote access, remediation of exposed credentials and hardening of VMware ESXi management interfaces rather than treating the disclosure or arrest as evidence that the ransomware threat has ended.