Qilin Ransomware Operator Unmasked

"The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone," according to a November 2026 report by the cybersecurity firm NCC Group.

Qilin’s business model and scope

Operating since September 2022, Qilin is described by NCC Group as a ransomware-as-a-service affiliate program that has become the most industrious of its kind. The group advertises an affiliate model that gives hackers at least 80 percent of any extortion amount paid by victims. Qilin’s operators practice “double extortion,” stealing sensitive data before encrypting systems and threatening to publish exfiltrated files. Unlike many Russia-based partnerships, Qilin has courted English-speaking affiliates and has publicly said it has collaborated with groups such as Scattered Spider and RansomHub.

From Haise to Rjun to Alexbigboss44: links across forums

The administrator of Qilin goes by the handle “Haise,” but records captured from the forum RAMP show a chain of earlier identities. Intel 471 indexed RAMP direct messages showing the RAMP administrator approved a user referred to as Haise and by the Telegram username Alexbigboss44. Intel 471 also found that the Alexbigboss44 handle had been used earlier, in 2020, by a user known as Rjun on the Russian cybercrime forums Exploit and XSS. Flashpoint describes that account as a prolific participant focused on the illicit trade of traffic, logs, and corporate access and as functioning as both a broker and operator.

Digital breadcrumbs: email, breached government records, Telegram and phone links

Investigators pivoted from forum usernames to tied contact details. Intel 471 records show Rjun registered at multiple Russian crime forums — Darkmarket, Verified, and Zloy — using the email address mail-30a@mail.ru. The identity-protection firm Spycloud found that mail-30a@mail.ru at one time used the password “Rjun132.” Constella Intelligence located that same email address in the breached records of gosuslugi.ru, the Russian state and municipal services platform, which was reportedly breached in late 2025. Those leaked Gosuslugi records link mail-30a@mail.ru to a 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg.

Additional pivots tied the online handles to a Telegram user ID and a Russian phone number. Flashpoint noted that Haise long used a Telegram account with user ID 118329521 and that more than 5,000 messages from that account date back to 2018. Constella linked that Telegram ID to the phone number +79602347275 and to the email addresses aleksey1990yakov@mail.ru and rjun123321@mail.ru. IntelHawk reported that the phone number +79602347275 belongs to Yakovtsev’s biological sister and that Aleksey often used his sister’s email address when registering at websites.

Travel and education records that fit the pattern

Publicly available institutional records were also cited. Rosobrnadzor records indicate that Aleksey Mikhailovich Yakovtsev attended grade school in Murmansk and holds a master’s degree in computing and information systems. Airline travel records exposed in breached Russian travel-agency data show an Aleksey Yakovtsev, born August 18, 1990, flew between St. Petersburg and Murmansk at least three times between 2013 and 2014. More recent travel records show frequent flights between St. Petersburg and Sochi; the available records cited do not show air travel outside of Russia.

Independent analysts, forum seizures, and the remaining open link

Multiple cyber-intelligence firms and independent analysts contributed to the chain of evidence: Intel 471 indexed RAMP messages; Flashpoint cataloged forum and Telegram activity; Spycloud identified reused credentials; Constella tied breached records and contact details; IntelHawk’s AI-based analysis linked historical usernames and behavioral signals. IntelHawk founder and CTO Leo Bogod summarized the trajectory as a progression “from novice arbitrageur and credit card fraudster in 2018–2019 to a more experienced participant and organizer of complex cybercrime-related activities in 2020–2023, with increasing attention to malware, botnets, and payment infrastructure.” An anonymous account called GangExposed reached similar conclusions and credited IntelHawk with helping to connect the dots.

One contextual milestone: the RAMP forum was seized by the FBI in January 2026, but the public record in this reporting shows Qilin continued to operate and to advertise its affiliate program (a now-deleted Qilin Telegram ad from July 2024 is among the cited artifacts). Attempts to reach Aleksey Mikhailovich Yakovtsev via email and phone were unsuccessful.

What this means for technologists, policymakers, and affected enterprises

• Technologists and security teams: Qilin’s scale — 365 victims in three months per NCC Group — and its double-extortion model reinforce the need to monitor for data-leak activity and to track extortion patterns linked to English-speaking affiliate recruitment.
• Policymakers and regulators: The seizure of RAMP in January 2026 shows law enforcement action against criminal forums, but the persistence of Qilin underscores that forum disruption does not immediately halt active affiliate programs.
• Affected enterprises and procurement leaders: The programmatic economics — affiliates receiving at least 80 percent of paid extortion amounts — increase incentives for compromise and rapid resale of access, elevating the risk profile for organizations that lack strong access controls and monitoring.

The record assembled in this reporting connects a sequence of forum registrations, Telegram activity, breached government records, email and phone ties, travel logs, and institutional education records to a single named individual: Aleksey Mikhailovich Yakovtsev of St. Petersburg. Investigative work cited here shows how repeated operational-security missteps can convert multiple online handles into a cohesive chain of identity — and it leaves unanswered whether law enforcement or prosecutors will use these links as the basis for charges. Attempts to contact Mr. Yakovtsev were unsuccessful, and for now the public trail ends with the assembled digital breadcrumbs and the continuing activity of the Qilin affiliate program.

https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/