NCC

Qilin Ransomware Administrator Identified as Aleksey Yakovtsev in St. Petersburg

The Qilin ransomware group has become the world's most active ransomware-as-a-service operation, claiming at least 365 victims in the past three months. Its administrator, known as Haise, made several operational security errors that allowed researchers to link the current handle to older aliases including Rjun and Alexbigboss44. Multiple intelligence platforms traced these identities through forum applications, Telegram accounts, and leaked databases back to 36-year-old Aleksey Mikhailovich Yakovtsev. The investigation combined data from Intel 471, Flashpoint, SpyCloud, and Constella Intelligence, including a breach of Russia's Gosuslugi portal. Yakovtsev's education records, flight history, and family phone numbers further corroborated the attribution. Qilin continues to attract English-speaking affiliates with an 80 percent revenue share and has collaborated with groups such as Scattered Spider.