Qilin ransomware group administrator de-anonymized as prolific Russian cybercrime operator

What happened

Qilin operates a ransomware-as-a-service model where affiliates receive at least 80 percent of any extortion payments. The group uses a double extortion tactic, stealing sensitive data before encrypting systems.

While the group maintains a high level of activity, its administrator, "Haise," left a trail of operational security mistakes spanning a decade. Intelligence analysis linked the Haise identity to older usernames, including "Rjun" and "Alexbigboss44," which were used on various Russian cybercrime forums. These identities were traced back to the email address [email protected]. This email appeared in records from a late 2025 breach of the Russian gosuslugi.ru digital platform, which identified the user as Aleksey Mikhailovich Yakovtsev, a St. Petersburg resident with a master's degree in computing.

Why it matters

This case demonstrates how even seasoned cybercriminals can be undone by historical operational security failures. By reusing usernames and email addresses across different criminal forums and personal services, the administrator created a bridge between his digital persona and his real-world identity. For defenders, the scale of Qilin's activity, over 365 victims in 90 days, shows the group is a highly industrious threat that relies on a large network of affiliates to execute attacks.

Who is affected

• Organizations targeted by Qilin ransomware

What to do now

1. Install updates for all operating systems, software, and firmware immediately.
2. Implement phishing-resistant MFA (such as hardware keys rather than SMS) for all services.
3. Train users to recognize and report phishing attempts.

What we don't know yet

• The exact root cause of the administrator's operational security failures.
• The total number of victims globally.