Who Runs the Ransomware Group Qilin?
Who Runs the Ransomware Group Qilin?
The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. The administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia. Operating since September 2022, the Russia-based ransomware group Qilin is currently the most industrious ransomware-as-a-service gang, according to a report this month by the cybersecurity firm NCC Group. Qilin attracts affiliates by offering them at least 80 percent of any extortion amount paid by victims. Its members practice the “double extortion” model, stealing sensitive data before encrypting systems and threatening to publish the files online. Qilin is happy to team with English-speaking affiliates, and its leader has shared on Telegram that they’ve worked with cybercrime groups like Scattered Spider and RansomHub.
The head of Qilin goes by the handle “Haise.” The cyber intelligence platform Intel 471 records that in June 2022, Haise applied for membership to RAMP, a Russian cybercrime forum. These messages show the RAMP administrator approved Haise’s application, referring to this user as Haise and by their Telegram username: Alexbigboss44. Searching Intel 471 for Alexbigboss44 reveals this was the Telegram account name shared by the user Rjun on the Russian cybercrime forums Exploit and XSS two years earlier in 2020. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access. Flashpoint says this user was engaged in high-volume acquisition of Facebook logs and Google Ads accounts to facilitate fraudulent advertising and gambling schemes, and that they functioned as a broker and operator.
Intel 471 finds that by the time Alexbigboss44 was applying for membership to RAMP, Rjun was already a longtime member of several other Russian crime forums. Intel 471 says Rjun signed up at all of these sites with the email address mail-30a@mail.ru. The identity threat protection firm Spycloud found the email address mail-30a@mail.ru at one time used the password “Rjun132.” A search for that email at the breach tracking service Constella Intelligence shows that it appeared in records maintained by gosuslugi.ru, the official digital platform for state and municipal services in the Russian Federation. Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers. According to the leaked Gosuslugi records, the address mail-30a@mail.ru belongs to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia. Flashpoint finds Haise has long used a Telegram account with the user ID 118329521, recording more than 5,000 messages since 2018. A search on this Telegram ID in Constella shows it is linked to the Russian phone number +79602347275.