Investigation Links Qilin Ransomware Administrator to St. Petersburg Resident

Russia-based ransomware-as-a-service operation Qilin claimed at least 365 victim organizations over the three months covered by a KrebsOnSecurity investigation, with NCC Group ranking it the most active ransomware affiliate program. Active since September 2022, Qilin uses data theft and encryption for double extortion. Its administrator, known as Haise, recruits affiliates by offering payouts of at least 80 percent.

KrebsOnSecurity linked Haise to older aliases Rjun and Alexbigboss44 through cybercrime forum messages, Telegram identifiers, and reused registration details. Breached government, travel, and other records reportedly connect those identities to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of St. Petersburg. The identification remains an investigative attribution, not one established through an official finding or an admission.