Krebs identifies a St. Petersburg man as Qilin ransomware admin
Original title: Who Runs the Ransomware Group Qilin?
Leaked records and forum pivots name 36-year-old Aleksey Yakovtsev; Qilin claims 365 victims in three months.
Krebs on Security reports that Qilin, operating since September 2022, is the most active ransomware-as-a-service program, with at least 365 claimed victims in three months, according to NCC Group. Affiliates get at least 80 percent of payments and steal data before encrypting systems. Intel 471, Flashpoint and others link administrator “Haise” through older handles to email mail-30a@mail.ru, which leaked Gosuslugi records attribute to Aleksey Mikhailovich Yakovtsev of St. Petersburg.
Unconfirmed: The naming of Yakovtsev rests on threat-intel pivots and leaked records, not an official charge.
- Haise applied to RAMP in June 2022 using Telegram name Alexbigboss44.
- The FBI seized RAMP in January 2026.
- Haise said on Telegram the group worked with Scattered Spider and RansomHub.
- A late-2025 Gosuslugi breach reportedly exposed more than 20 million records.
- Rosobrnadzor records say Yakovtsev studied in Murmansk and holds a computing master’s degree.
- Threat actors
- QilinScattered SpiderRansomHub
- Organizations
- NCC GroupIntel 471FlashpointIntelHawkFBI
- Countries
- Russia
From the original article
5 min read at krebsonsecurity.com
The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.
By BrianKrebs · krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.