Qilin, which the cybersecurity firm NCC Group ranks as the world's most active ransomware-as-a-service operation, claimed at least 365 victim organisations in the past three months alone. Now an investigation by KrebsOnSecurity argues that a decade of operational security slip-ups by its administrator, known as "Haise", point to a 36-year-old man living in St. Petersburg, Russia. He has not been charged, and attempts to reach him by email and phone were unsuccessful.
How Qilin works. Operating since September 2022, Qilin recruits affiliates to break into companies and deploy ransomware, offering them at least 80 percent of any ransom paid. Its members use double extortion: they steal sensitive data before encrypting systems and threaten to publish the files. Unlike most Russia-based groups, Qilin works with English-speaking affiliates, and its leader has said on Telegram that it has teamed up with groups such as Scattered Spider and RansomHub.
The trail of nicknames. According to the cyber intelligence platform Intel 471, Haise applied to join the Russian cybercrime forum RAMP in June 2022. Direct messages from RAMP, which the FBI seized in January 2026, show the forum's administrator approving the application and linking Haise to the Telegram username Alexbigboss44. That same handle had been shared in 2020 by a user called Rjun on the forums Exploit and XSS.
From fraud to ransomware. Flashpoint says the Alexbigboss44 account was heavily involved in buying Facebook logs and Google Ads accounts to fuel fraudulent advertising and gambling schemes. The link between the identities was first shared by IntelHawk, an AI-based de-anonymisation platform. Its founder, Leo Bogod, describes a progression from novice credit card fraudster in 2018–2019 to an organiser of complex cybercrime by 2020–2023.
Leaked records close the loop. Intel 471 says Rjun registered on several forums with a single mail.ru address. Breach data indexed by Constella Intelligence shows that address in records from Gosuslugi, Russia's state services portal, which was breached in late 2025. Those records tie it to a named 36-year-old from St. Petersburg. Breached flight records and education data add further detail. The anonymous account GangExposed reached similar conclusions.
Why it matters
Opsec always leaks. The case shows how cybercriminals' own data trails, from reused emails to seized forums and breached government databases, can expose people behind major gangs. For businesses, though, Qilin's pace shows the threat is not slowing down.
- Assume attackers will steal data before encrypting it; backups alone do not stop extortion.
- Watch for stolen access being sold: protect remote logins with multi-factor authentication.
- Keep offline, tested backups and an incident response plan ready.
Source: Krebs on Security
Leave a Reply