Ransomware Group Qilin's Administrator Identified as St. Petersburg Resident
Investigations into the highly active Qilin ransomware-as-a-service group have reportedly identified its administrator, known as 'Haise,' as a 36-year-old individual residing in St. Petersburg, Russia.
The ransomware-as-a-service (RaaS) group Qilin has rapidly ascended to become the most active affiliate program in the cybercrime landscape, reportedly targeting at least 365 organizations within a mere three-month period. This aggressive expansion has drawn significant attention, not only for its operational scale but also for the potential identification of its core administrator.
Investigations by cybersecurity firms and threat intelligence platforms suggest that the individual operating under the handle 'Haise' is a 36-year-old resident of St. Petersburg, Russia. While Qilin has been active since September 2022, its administrator's digital footprint reveals a longer history of involvement in cybercrime, marked by several operational security (opsec) missteps over the past decade. These errors have allowed researchers to link the 'Haise' persona to earlier online activities, including data brokering and fraudulent schemes.
Qilin operates on a ransomware-as-a-service model, attracting affiliates by offering them a substantial cut—at least 80 percent—of any ransom payments. The group employs the common 'double extortion' tactic, exfiltrating sensitive data before encrypting victim systems and threatening to leak the stolen information if the ransom is not paid. Notably, Qilin distinguishes itself by actively recruiting English-speaking affiliates, a departure from many Russia-based ransomware operations that tend to be more insular.
The administrator's past aliases, such as 'Rjun' and 'Alexbigboss44,' were uncovered through analysis of seized cybercrime forums and direct messages. For instance, 'Haise' applied for membership on the RAMP forum under the Telegram username 'Alexbigboss44.' Subsequent investigations linked 'Alexbigboss44' to the earlier username 'Rjun' on forums like Exploit and XSS from around 2020. This progression indicates a shift from less sophisticated activities to more organized cybercrime operations.
Further analysis by threat intelligence platforms like Flashpoint and Intel 471 connected these aliases to a pattern of high-volume data acquisition, including Facebook logs and Google Ads accounts, used for fraudulent advertising and gambling. The individual also acted as a broker, managing networks of traffickers and purchasing compromised data to fuel their operations.
The crucial link to a real-world identity emerged when researchers traced the email address '[email protected],' associated with 'Rjun,' to leaked data from Gosuslugi.ru, Russia's official digital platform for state services. This breach exposed over 20 million records, including personal details. The Gosuslugi data indicated that the email address belonged to Aleksey Mikhailovich Yakovtsev, a 36-year-old from St. Petersburg.
Additional digital breadcrumbs, including a Telegram user ID and associated phone numbers, further corroborated the identity of Aleksey Yakovtsev. Records from Russia's education watchdog show he attended school in Murmansk and holds a master's degree in computing and information systems. The investigation highlights how even sophisticated cybercriminals can leave traces that, when pieced together, can lead to their de-anonymization, underscoring the persistent challenges in maintaining operational security in the digital underground.