Investigators tie Qilin administrator Haise to St. Petersburg man

Open-source investigators have linked Qilin ransomware administrator Haise to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of St. Petersburg, Russia, through reused forum handles, a shared e-mail, leaked government records, and phone and travel data.

As of Nov. 11, 2026, no law enforcement agency had confirmed that Yakovtsev is Haise or controls Qilin, and the identification remains an unverified open-source assessment. The alleged identification first became public on Nov. 6, 2026, when SOCRadar reported that the GangExposed Telegram channel had published an investigation into Haise, describing the claim as unverified.

Investigators tied the handle Haise to the Telegram username Alexbigboss44 and the older forum name Rjun. In June 2022, Haise applied for membership on the RAMP cybercrime forum, and the forum administrator associated the application with the Telegram name Alexbigboss44. Rjun registered on the Darkmarket, Verified, and Zloy forums using the email mail-30a@mail.ru.

The e-mail mail-30a@mail.ru appeared in records from gosuslugi.ru, Russia’s state and municipal services portal, which was breached in late 2025 and reportedly exposed more than 20 million records. Leaked Gosuslugi records associate mail-30a@mail.ru with Aleksey Mikhailovich Yakovtsev, born Aug. 18, 1990, of St. Petersburg. SpyCloud found that mail-30a@mail.ru once used the password Rjun132; KrebsOnSecurity notes SpyCloud is an advertiser on its blog.

Rosobrnadzor records indicate Yakovtsev went to grade school in Murmansk and completed a master’s program in computing and information systems. Flight records show Yakovtsev traveled between St. Petersburg and Murmansk at least three times from 2013 to 2014, and more recently flies between Saint Petersburg and Sochi but has not traveled by plane outside Russia. Attempts to contact Yakovtsev by e-mail and phone were unsuccessful.

IntelHawk states that phone number +79602347275 links to aleksey1990yakov@mail.ru and rjun123321@mail.ru, and that the number belongs to Yakovtsev’s biological sister. IntelHawk privately shared earlier this month the link tying Haise to the older Rjun and Alexbigboss44 accounts; the AI-based platform de-anonymizes threat actors using historical usernames, stylometry, and other signals.

According to Flashpoint, Alexbigboss44 acted as a broker and operator who ran a network of traffickers and bought compromised data for fraudulent advertising and gambling schemes. Flashpoint recorded Haise using Telegram user ID 118329521 with more than 5,000 messages since 2018. Cyberoly reported Haise’s Telegram user ID as 238209867, linked to phone number +79602347275.

KrebsOnSecurity records that the Telegram name Alexbigboss44 appeared in 2020 shared by user Rjun on the Exploit and XSS forums. Cyberoly says Alexbigboss44 operated as Rjun on Exploit and XSS as early as 2018, primarily as a broker for stolen Facebook logs, Google Ads accounts, and traffic.

An anonymous Twitter/X account called Gang Exposed reached similar conclusions about Haise’s identity, crediting IntelHawk’s platform for helping connect the dots. Threat intelligence firm KELA participated in the analysis of Haise’s identity alongside Intel 471, Flashpoint, SpyCloud, and IntelHawk.

Qilin has operated as a Russia-based ransomware-as-a-service group since September 2022. Qilin began as the Agenda ransomware in July 2022 and was rebranded as Qilin in September 2022.

NCC Group recorded 365 claimed Qilin attacks in Q3 2026, compared with 359 for The Gentlemen, the next most active operation; the count makes Qilin the world’s most active ransomware affiliate program according to the firm.

Qilin offers affiliates at least 80 percent of extortion payments and works with English-speaking partners, including collaboration with Scattered Spider and RansomHub. Qilin payment splits give affiliates 80 to 85 percent, with operators retaining 15 to 20 percent. Group-IB documented payout terms in 2023: affiliates kept 80 percent of ransoms of $3 million or less and 85 percent above that.

The ransomware operation is run by a core team that builds and maintains malware while recruited affiliates run intrusions and split proceeds. The Qilin affiliate control panel had six sections: Targets, Blogs, Stuffers, News, Payments, and FAQs. By June 2025, the Qilin panel included a Call Lawyer button for ransom negotiations. Qilin offered affiliates in-house writers, DDoS capabilities, spam-tooling, and a petabyte of storage per The Register.

Qilin intrusions often start with valid credentials exposed on criminal channels from one week to three months before use. JPCERT/CC’s JSAC 2026 analysis traced Qilin credentials to Telegram channels, breach forums, and MEGA, exposed one week to three months before intrusion. Phishing and fake CAPTCHA pages are Qilin initial access vectors per HHS HC3 and Trend Micro.

Cisco Talos documented attackers using leaked credentials to access a VPN without multifactor authentication. Its researchers also documented SharpDecryptPwd, WebBrowserPassView, and Mimikatz harvesting Chrome passwords; CERT Santé described a Group Policy script harvesting credentials for three days. In April 2026, the firm traced a loader using msimg32.dll to load rwdrv.sys, a signed TechPowerUp LLC ThrottleStop.sys copy, and hlpdrv.sys to kill security processes, disabling over 300 EDR drivers via bring your own vulnerable driver, or BYOVD.

Qilin affiliates use NetScan, PsExec, Cobalt Strike, SystemBC, AnyDesk, Splashtop, and Atera for discovery, movement, and remote access. Qilin exfiltrates data using WinRAR, Cyberduck, and s5cmd before encryption. Qilin removes volume shadow copies, disables vCenter HA and DRS, clears event logs, can self-delete, and reboots into Safe Mode.

CyPro lists Qilin’s hybrid encryption with ChaCha20 and RSA-4096, randomized extensions such as .MmXReVIxLV, and ransom notes such as README-RECOVER-<ID>.txt; one sample has SHA256 hash 5acd1ff8da9958a032cf63fb27d5e4b71c201612461e039f44eb07b2cc6735c0. Adaptive Security states Qilin.B employs an encryption scheme that prevents recovery unless the attacker holds the key.

In 2025 casework, Qilin ransomware executed an average of 6.1 days after intrusion detection. JPCERT/CC’s analysis of Japanese 2025 casework found Qilin represented 16.4 percent of 134 incidents, about 22 cases; responding within one to two days avoided severe outcomes in about a third of cases. No free decryptor for any Qilin ransomware variant exists as of August 2026.

Qilin encryptors target Nutanix AHV in addition to Windows, Linux, and VMware ESXi; Trend Micro documented Nutanix AHV targeting in October 2025. Qilin’s leak sites and command servers use bulletproof hosting through Red Bytes LLC, registered in Saint Petersburg, according to Resecurity reporting from October 2025. MITRE ATT&CK tracks Qilin as Water Galura (G1050), the malware as Qilin (S1242) with Agenda as an alias, and lists GOLD FEATHER.

The HHS HC3 threat profile, assessed in June 2024, found Qilin likely originates from Russia. Group-IB infiltrated the Qilin affiliate program in 2023 and found recruitment advertisements in Russian on RAMP stating the group does not work in CIS countries.

Adaptive Security found that Qilin’s victims include healthcare organizations, food and beverage manufacturers, automotive design firms, and financial services companies, though confirmed impact was lower than claimed.

The Synnovis attack on June 3, 2024, disrupted blood testing across seven south London organizations serving Guy’s and St Thomas’ and King’s College Hospital trusts. The June 2024 Synnovis attack left 161,560 pathology reports unentered into NHS patient records as of January 2026, alongside 122 patient-safety incidents. Qilin leaked stolen Synnovis information through its data-leak site and Telegram channel on June 20, 2024.

The company refused to pay, its forensic review ended in November 2025, and notifications ran from November 10 to November 21, 2025. CaseMatrix estimated over 900,000 people affected by Synnovis, an estimate Synnovis never confirmed; Qilin told Bloomberg in June 2024 it demanded $50 million. Mid and South Essex NHS Foundation Trust learned of roughly 2,380 affected records toward the end of 2025; Bedfordshire Hospitals NHS Foundation Trust reported just under 30,000 affected patients.

Asahi Group Holdings disclosed a September 29, 2025, cyber attack halting six Japanese production facilities. Asahi’s November 27, 2025, investigation counted roughly 1,914,000 affected individuals; Qilin claimed 9,300 files totaling 27 GB; Asahi never confirmed Qilin responsible.

Nissan confirmed suspicious access to Creative Box Inc. on August 16, 2025; Qilin claimed 4 TB of design and financial data; Nissan did not confirm volume or contents. A South Korean managed service provider breach produced 28 Qilin victims, 24 in finance, over 1 million files and roughly 2 TB; Moonstone Sleet involvement unconfirmed.

Microsoft observed the North Korean state actor Moonstone Sleet deploying Qilin ransomware starting in late February 2025. MITRE ATT&CK lists Moonstone Sleet (G1036) among groups using Qilin. OFAC’s September 21, 2021, advisory prohibits US persons from transacting with SDN entities and allows civil penalties under strict liability; OFAC designated Lazarus Group and subgroups in September 2019.

No arrest, indictment, sanction, seizure, or joint government advisory has targeted Qilin as of August 2026. CISA and FBI issued a Gunra advisory on August 10, 2026; Qilin has no joint advisory; the only US government product on Qilin is the HHS HC3 threat profile from June 18, 2024.

Microsoft reported in 2024 that Scattered Spider incorporated Qilin and RansomHub payloads into its toolkit. Qilin collaborated with Black Basta. Some Qilin incidents involved a clearnet IP address for victim communications without Tor.

RAMP was created to serve as a safe haven for ransomware affiliate programs; Intel 471 described it as a closely-guarded Russian cybercrime forum built for ransomware affiliates. The FBI seized the RAMP forum on January 28, 2026. A profile for Haise appeared on RAMP on May 29, 2022. Haise advertised the Qilin affiliate program on RAMP in February 2023.

Researcher Graham Cluley assessed Qilin’s goals.

"their goal is just to attract more affiliates, increase the success rate of ransomware attacks."

Graham Cluley, Adaptive Security