# Unmasking the Administrator Behind the Qilin Ransomware Group Digital forensic analysis links a prolific cybercriminal to a St. Petersburg resident. - **Source:** [Krebs on Security](https://brifing.si/source/0a287077-2ca9-4c5d-b9aa-b7b61aa8e436) - **Published:** 2026-11-11 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/c26f786e-e159-4a00-b505-fee6de219943 ## Qilin's Rapid Rise Qilin has established itself as the world's most active ransomware affiliate program, targeting at least 365 organizations in just three months. Operating since September 2022, the group utilizes a ransomware-as-a-service model. They entice affiliates by offering them 80 percent of extortion payments, while employing double extortion tactics to maximize financial pressure on victims. ## Operational Security Failures The group's administrator, known by the handle Haise, made critical mistakes by linking current criminal activities to older, less secure online identities. Cybercriminals often change handles to maintain anonymity, but Haise referenced past monikers when applying for membership at the RAMP forum. These historical breadcrumbs allowed researchers to trace the leader's digital footprint. ## Connecting Digital Identities Intelligence platforms identified that Haise previously operated under the alias Rjun and used the Telegram handle Alexbigboss44. These accounts were active on various Russian cybercrime forums as early as 2020. Investigations revealed that the user transitioned from credit card fraud and illicit traffic brokering to managing complex, large-scale ransomware operations over several years. ## The Breach That Exposed Him A critical breakthrough occurred following the 2025 breach of Gosuslugi, Russia's official digital services platform. The leak exposed over 20 million records, including the email address mail-30a@mail.ru. This specific email was previously linked to the Rjun account across multiple forums, providing a direct bridge between the cybercriminal alias and a real-world identity. ## Identity of the Administrator Leaked government records identify the individual behind the email as 36-year-old Aleksey Mikhailovich Yakovtsev, residing in St. Petersburg. Further analysis of Telegram user IDs and associated phone numbers confirmed the link. The phone number +79602347275, used by the administrator, is registered to Yakovtsev's sister and appears in various leaked travel agency databases. ## Background and Travel History Public records from Russia's education watchdog, Rosobrnadzor, indicate that Yakovtsev holds a master's degree in computing and information systems. Flight records obtained from breached travel agency data show he frequently travels between St. Petersburg and Sochi. These records confirm his identity and provide a clear timeline of his movements within the Russian Federation. ## Collaborative De-anonymization Efforts The identification of Yakovtsev was supported by IntelHawk, an AI-based platform that analyzes historical usernames and stylometry to de-anonymize threat actors. Independent researchers and the anonymous account Gang Exposed reached similar conclusions by connecting these disparate data points. This collective effort highlights how modern intelligence tools can effectively pierce the veil of cybercriminal anonymity. ## Implications for Future Operations The exposure of Qilin's administrator serves as a stark reminder of the limitations of operational security in the age of massive data breaches. As researchers continue to map the infrastructure of ransomware gangs, the ability to link digital handles to physical identities becomes a powerful tool for law enforcement and global cybersecurity defense efforts. ## Sources covering this story - https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._