Researchers tie Qilin admin Haise to a St. Petersburg man
Original title: Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe
The KrebsOnSecurity finding is not a charge, and Qilin’s claimed victim total is not an independently verified breach count.
A KrebsOnSecurity investigation published November 11 links the Qilin ransomware administrator “Haise” to Aleksey Mikhailovich Yakovtsev, 36, of St. Petersburg. Researchers connected reused forum names, a Telegram identity, an email and leaked Russian records, including Gosuslugi data. Qilin, a ransomware-as-a-service operation since September 2022, claims at least 365 victims over three months; NCC Group called it the most active affiliate program. Affiliates keep at least 80 percent of payments and use double extortion. Attempts to reach Yakovtsev failed.
Unconfirmed: The identification is a research finding, not a court ruling or announced charge, and the 365 victims are claims rather than confirmed breaches.
- Intel 471 records show Haise applied to the RAMP forum in June 2022.
- Flashpoint logged more than 5,000 messages for the Telegram identity since 2018.
- Constella linked a forum email to leaked Gosuslugi records naming Yakovtsev.
- Earlier reporting described Qilin attacks on VMware vCenter and ESXi.
- Researchers say a nickname change does not mean the operation has stopped.
Impact: Encrypts systems after stealing files and threatening publication
From the original article
3 min read at cybersecuritynews.com
A cybercrime investigation has linked the administrator of Qilin ransomware to Aleksey Mikhailovich Yakovtsev, a 36-year-old man living in St. Petersburg, Russia. Published by KrebsOnSecurity on November 11, 2026, the findings connect the online identity “Haise” to older forum accounts, Telegram records, and leaked databases.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.