Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Krebs ties Qilin admin Haise to 36-year-old Aleksey Yakovtsev

4 sources · 4 articlesFirst reported Updated ()
What's new

November 12: Cyber Security News adds that Flashpoint logged more than 5,000 Telegram messages since 2018, cites earlier Qilin attacks on VMware vCenter and ESXi, and says a nickname change does not mean the operation stopped.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A Krebs investigation names a St. Petersburg man as Qilin administrator Haise; it is not a court finding.

Brian Krebs reported on November 11 that operational-security mistakes over a decade point to Aleksey Mikhailovich Yakovtsev, 36, of St. Petersburg, as administrator “Haise” of Qilin, a ransomware-as-a-service group since September 2022. According to NCC Group, Qilin is the most active such program, with at least 365 claimed victims in three months; those figures are claims, not verified payments. Affiliates receive at least 80 percent and steal data before encryption. Intel 471, Flashpoint, Constella and others link Haise through older handles and a Telegram identity to mail-30a@mail.ru, which leaked Gosuslugi records attribute to Yakovtsev. Contact attempts failed, and the identification is not a charge or court finding.

Key facts
  • Qilin has run as ransomware-as-a-service since September 2022.
  • NCC Group: at least 365 claimed victims in three months.
  • Affiliates keep at least 80 percent under double extortion.
  • Haise applied to RAMP in June 2022 as Telegram user Alexbigboss44.
  • Flashpoint logged more than 5,000 Telegram messages for that identity since 2018.
  • The FBI seized RAMP in January 2026.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 11, 2026Krebs publishes investigation naming Yakovtsev as Haise. · Krebs on Security

What each outlet adds

beyond the shared facts
  • Krebs on SecurityEmail, Gosuslugi attribution, RAMP seizure, Scattered Spider claim, education records.
  • GBHackersConstella email link, sister’s phone, and that victim totals are unverified claims.
  • Cyber Security NewsMore than 5,000 Telegram messages since 2018 and prior vCenter and ESXi attacks.
  • DataBreaches.netNotes Krebs previously ranked The Gentlemen second most active.
Threat actors
QilinThe GentlemenScattered SpiderRansomHub
Organizations
NCC GroupIntel 471FlashpointIntelHawkFBIKrebsOnSecuritySpyCloudConstella Intelligence
Countries
Russia

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Krebs on SecurityFirst report

    Krebs identifies a St. Petersburg man as Qilin ransomware admin

    Leaked records and forum pivots name 36-year-old Aleksey Yakovtsev; Qilin claims 365 victims in three months.

  2. · 14h ago GBHackers

    Qilin ransomware admin allegedly identified as Russian man

    A KrebsOnSecurity report ties the alias Haise to Aleksey Yakovtsev using forum, Telegram and leaked records; it is not a court finding.

  3. · 11h ago DataBreaches.net

    Krebs links Qilin ransomware admin to a man in St. Petersburg

    NCC Group ranks Qilin the busiest ransomware-as-a-service program, with at least 365 claimed victims in three months.

  4. · 10h ago Cyber Security News

    Researchers tie Qilin admin Haise to a St. Petersburg man

    The KrebsOnSecurity finding is not a charge, and Qilin’s claimed victim total is not an independently verified breach count.