Investigators say they have identified the administrator of Qilin, the ransomware operation described as the world's most active ransomware-as-a-service programme, as a 36-year-old man living in St Petersburg, Russia.

The findings were published by KrebsOnSecurity on 11 November 2026. They name the man as Aleksey Mikhailovich Yakovtsev and link him to the online handle "Haise", under which Qilin's administrator recruits affiliates. The identification is the result of an investigation by researchers, not a court ruling, and no law enforcement agency has confirmed it.

How the trail was followed

According to the report, the chain begins in June 2022, when Haise applied to join RAMP, a private Russian-language cybercrime forum set up for ransomware affiliate programmes. Records indexed by the threat intelligence platform Intel 471 show the forum administrator approving the application and referring to the applicant both as Haise and by the Telegram username Alexbigboss44.

That username turned out to be the weak link. Intel 471 records show Alexbigboss44 was the Telegram name shared by a user called Rjun on the Russian cybercrime forums Exploit and XSS in 2020. Rjun had registered on several other forums, including Darkmarket, Verified and Zloy, using the email address mail-30a@mail.ru.

A search of that address at the breach tracking service Constella Intelligence showed it appearing in records from Gosuslugi, Russia's official digital services platform, which was breached in late 2025 in an incident reportedly exposing more than 20 million records. According to those leaked records, the address belongs to Yakovtsev.

Other records line up behind the same name. Flashpoint found that Haise has used a Telegram account with the ID 118329521, recording more than 5,000 messages since 2018. Education records show Yakovtsev attended grade school in Murmansk and holds a master's degree in computing and information systems. Flight records show a man of that name, born 18 August 1990, flying between St Petersburg and Murmansk in 2013 and 2014, and travelling frequently between St Petersburg and Sochi since then.

From small fraud to a ransomware empire

The threat intelligence platform IntelHawk, which shared the link between the Haise and Rjun identities, described a progression from small-scale arbitrage and credit card fraud in 2018 and 2019 to more organised activity involving malware, botnets and payment infrastructure between 2020 and 2023.

Qilin has operated since September 2022. A report published this month by the cybersecurity firm NCC Group calls it the most industrious ransomware-as-a-service gang currently active, claiming at least 365 victim organisations in the space of three months. The group recruits affiliates by offering them at least 80 percent of any extortion payment, and uses the double extortion model: stealing sensitive data before encrypting systems, then threatening to publish the files if no ransom is paid.

Unlike most Russian-based ransomware partnerships, Qilin is willing to work with English-speaking affiliates. Its leader has said on Telegram that the group has worked with actors associated with Scattered Spider and RansomHub.

What happens next

KrebsOnSecurity said attempts to reach Yakovtsev by email and phone were unsuccessful. An anonymous account known as GangExposed, which has previously identified suspected ransomware actors, is reported to have reached similar conclusions about Haise's identity.

For now the identification remains an allegation based on leaked records and forum history rather than a charge. No law enforcement action against Yakovtsev has been reported, and suspects based in Russia are difficult for Western authorities to reach. But if the link holds, it would be a rare unmasking of the person behind the ransomware operation that has claimed more victims than any other in recent months.

Sources: Krebs on Security, Cybernews