Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe

A cybercrime investigation has linked the administrator of Qilin ransomware to Aleksey Mikhailovich Yakovtsev, a 36-year-old man living in St. Petersburg, Russia.

Published by KrebsOnSecurity on November 11, 2026, the findings connect the online identity “Haise” to older forum accounts, Telegram records, and leaked databases. The identification remains a research finding, not a court ruling or announced criminal charge.

The report comes as Qilin claims at least 365 victim organizations over three months. Citing NCC Group, Krebs described the operation as the world’s most active ransomware affiliate program. Those figures represent claimed victims rather than a confirmed count of independently verified breaches.

The investigation followed a trail of reused identities. According to Intel 471 records cited by Krebs, Haise applied to join the Russian cybercrime forum RAMP in June 2022. Private messages showed the forum administrator referring to the applicant as both Haise and the Telegram username Alexbigboss44.

That Telegram name appeared in posts made during 2020 by “Rjun” on the Exploit and XSS forums. Researchers connected the newer ransomware identity to accounts active years before Qilin became a major threat. Flashpoint described Alexbigboss44 as a frequent buyer and trader of stolen account data, online traffic, and corporate access.

Qilin Ransomware Admin Identified as Russian Hacker

IntelHawk helped connect these identities through historical usernames and other signals. Its founder, Leo Bogod, described a progression from small fraud schemes in 2018 and 2019 toward more organized activity involving malware, botnets, and payment systems between 2020 and 2023.

The next link came from an email address used to register Rjun accounts on several criminal forums. SpyCloud found a historical password containing the Rjun alias. Constella Intelligence then linked the email to leaked records from Russia’s Gosuslugi government services platform, identifying Yakovtsev, the report said.

Additional checks involved a persistent Telegram account identifier, related contact records, and leaked travel data. Flashpoint had recorded more than 5,000 messages associated with that Telegram identity since 2018. Together, these records formed the reported attribution chain. Krebs said attempts to reach Yakovtsev for comment were unsuccessful.

Operating since September 2022, Qilin runs a ransomware-as-a-service program. Its affiliates break into victim networks and deploy ransomware in exchange for at least 80 percent of ransom payments. The group uses double extortion, stealing sensitive files before encrypting systems and threatening to publish the stolen information.

Its technical reach extends beyond ordinary workstations. Earlier Cybersecuritynews.com reporting examined Qilin attacks targeting VMware vCenter and ESXi, including remote management tools, network spreading, and vulnerable drivers used to turn off security products. Attacks against virtual infrastructure can disrupt multiple business systems through one compromised management layer.

Separate coverage of Qilin’s use of bulletproof hosting detailed infrastructure supporting its extortion activity. Such hosting arrangements help criminal services remain online despite abuse complaints and efforts to disrupt them.

The investigation highlights a weakness in long-running criminal operations. Changing a nickname does not erase older account links. Reused contact details and persistent platform identifiers can allow researchers to connect separate identities years later.

However, the reported links should not be treated as proof of guilt, and identifying a suspected administrator does not establish that Qilin’s ransomware operations have stopped or that victims face less risk.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe appeared first on Cyber Security News.