Researchers say they have identified the administrator of Qilin, the world’s most active ransomware-as-a-service group, as a 36-year-old man from St Petersburg, Russia. KrebsOnSecurity reported on 11 November that reused usernames, Telegram accounts and leaked records point to Aleksey Mikhailovich Yakovtsev.

Qilin has operated since September 2022 and, according to a report this month by cybersecurity firm NCC Group, has claimed at least 365 victim organisations in the past three months alone. The group recruits affiliates by offering them at least 80 percent of any extortion payment, and uses “double extortion” — stealing sensitive data before encrypting systems and threatening to publish it online.

How researchers traced “Haise”

The group’s leader uses the handle “Haise”. According to threat intelligence firm Intel 471, Haise applied to join RAMP, a Russian cybercrime forum, in June 2022, giving the Telegram username “Alexbigboss44”. That username had been shared years earlier by a forum user called “Rjun” on the Exploit and XSS forums; Flashpoint records show the same Telegram account posting more than 5,000 messages since 2018.

The chain then led to an email address Rjun used to register on crime forums, which appears in leaked records from Gosuslugi, Russia’s state services platform, breached in late 2025 with more than 20 million records reportedly exposed. Those records name the account holder as Yakovtsev, who holds a master’s degree in computing and information systems. Travel records and phone data also supported the identification.

The finding is a researchers’ allegation, not a court ruling or an announced criminal charge, and no law enforcement agency has confirmed it. Cybernews, which also reported the identification, noted that Yakovtsev has reportedly never travelled by plane outside Russia, making any arrest there unlikely. KrebsOnSecurity said attempts to contact him were unsuccessful.