Cybersecurity investigators have linked the administrator of the Qilin ransomware operation to a 36-year-old Russian man living in St. Petersburg. The findings emerged from an investigation into historical cybercrime forum accounts, leaked government records, and online identities associated with the group’s leadership.
The individual identified by researchers is Aleksey Mikhailovich Yakovtsev, who allegedly operates under the nickname Haise. Although several cybersecurity intelligence companies have contributed evidence supporting the connection, law enforcement authorities have not publicly confirmed his involvement in Qilin.
Qilin has become one of the most active ransomware-as-a-service operations, claiming at least 365 victim organizations over the past three months. Active since 2022, the group recruits affiliates to compromise corporate networks and deploy ransomware in exchange for a substantial share of extortion payments.
Affiliates reportedly receive at least 80% of collected ransom payments. The operation typically uses double extortion, stealing confidential information before encrypting systems and threatening to publish the stolen material if victims refuse to pay.
According to KrebsOnSecurity, the investigation into Haise began with older online identities that the suspected administrator allegedly used before becoming associated with Qilin. Researchers discovered that an application submitted to the Russian cybercrime forum RAMP in June 2022 contained a Telegram username that connected Haise to earlier activity.
According to intelligence collected by Intel 471, messages from RAMP referred to Haise using the Telegram account Alexbigboss44. The same username had previously appeared in connection with an individual known as Rjun on the Exploit and XSS underground forums.
Additional research by Flashpoint linked these accounts to activities involving compromised online accounts, stolen information, fraudulent advertising, and trading access to corporate systems.
Cybersecurity platform IntelHawk examined the historical identities and identified a progression from alleged payment card fraud and traffic manipulation during 2018 and 2019 to more complex cybercriminal activity involving malware, botnets, and payment infrastructure.
The investigation subsequently connected Rjun to an email address used to register accounts on several Russian underground forums. Researchers searched previously leaked databases and found that the same address appeared in records associated with Gosuslugi, Russia’s government services portal.
According to those records, the email address belonged to Yakovtsev. Additional information obtained from Russian educational databases indicated that he attended school in Murmansk and obtained a master’s degree in computing and information systems.
Investigators also examined historical Telegram identifiers and travel records, identifying further connections between the suspected administrator’s online accounts and Yakovtsev.
The findings show how reusing usernames, contact details, and account information across different platforms can undermine attempts to maintain anonymity. Even when individuals adopt new online identities, historical records can preserve connections to their earlier activity.
However, the evidence remains circumstantial. The investigation establishes links between several online accounts and personal records but does not constitute a judicial determination that Yakovtsev operates Qilin.
Researchers also reported that attempts to contact Yakovtsev were unsuccessful. Available travel records indicated domestic flights within Russia but did not establish that he had traveled internationally.