Security

Who Runs the Ransomware Group Qilin?

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 11/11/2026, 18:18:25 UTC.

Briefings

Cybersecurity firm NCC Group identified Qilin as the world's most active ransomware affiliate program, operating since September 2022 with at least 365 victims in three months. The group's administrator, Haise, operates from St. Petersburg and uses the double extortion model to offer 80% of extortion amounts. Intelligence analysis traced Haise's identity to a 36-year-old man named Aleksey Yakovtsev, revealing a progression from credit card fraud to organized cybercrime operations. The investigation uncovered connections to a 2020 forum user and a 2025 Gosuslugi breach, though the full scope of the sister's involvement remains partially obscured by the source text.

Key points

• Qilin ransomware group emerged as the world's most active affiliate program with at least 365 victims in the past three months.
• The group's administrator, Haise, is linked to a 36-year-old man named Aleksey Yakovtsev from St. Petersburg, Russia.

Context

NCC Group reported Qilin as the most industrious ransomware-as-a-service gang, noting its operational security mistakes and long-term history of missteps. The investigation connects the current group leader to a 2020 forum user and a 2025 state service breach, suggesting a progression from novice fraud to organized cybercrime operations.

Limitations

Source evidence is limited to specific intelligence findings and does not include full details of the 365 victims, the complete timeline of Yakovtsev's activities, or the full extent of the sister's involvement in the Gosuslugi breach.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 11/11/2026, 19:29:11 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeihht6wk2g3kijlrisjy6hy7kabo6qw2hhaxakhsa5b6v324mhhepu