Security

Who Runs the Ransomware Group Qilin?

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 12/11/2026, 01:48:24 UTC.

Briefings

Cybersecurity firm NCC Group reports Qilin ransomware group as the world's most active affiliate program, operating since September 2022 with at least 365 victims in three months. The group's administrator, identified as Haise, operates from St. Petersburg, Russia, and uses a double extortion model to offer affiliates 80% of extortion amounts. Intelligence analysis links Haise to a 36-year-old man named Aleksey Yakovtsev, who was previously known as Rjun and Alexbigboss44, based on shared Telegram handles and forum activity. Yakovtsev holds a master's degree in computing and has connections to a breached state service platform, with his sister also linked to his communications.

Key points

• Qilin ransomware group emerged as the world's most active affiliate program in September 2022, operating with at least 365 victims in the past three months.
• The group's administrator, Haise, operates from St. Petersburg, Russia, and uses a double extortion model to offer affiliates 80% of extortion amounts.

Context

Qilin is the most industrious ransomware-as-a-service gang globally, operating since September 2022. Unlike most Russian groups, it actively recruits English-speaking affiliates. Its leader, Haise, has been identified through intelligence analysis as a 36-year-old man named Aleksey Yakovtsev, formerly known as Rjun, based on shared Telegram handles and forum activity patterns.

Limitations

Intel 471 records show Haise applied for RAMP membership in June 2022, but the forum was seized by the FBI in January 2026, limiting full operational history. Flashpoint data indicates Yakovtsev's early activities focused on traffic and logs, with later escalation to malware and botnets. Gosuslugi breach records from late 2025 may not capture all connections, and some phone number links appear incomplete in the provided evidence.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 12/11/2026, 02:59:54 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeicdpx23uusbrdl2sdokza4jpg6i6p7uatsfebv3rup3sw3ijvt7im