Summary
- Qilin is currently the most prolific ransomware-as-a-service operation globally, claiming at least 365 victim organisations in the past three months, according to NCC Group.
- The group's administrator, known as 'Haise', has been linked through forum records, breach data, and leaked government databases to Aleksey Mikhailovich Yakovtsev of St. Petersburg, Russia.
- The attribution trail spans more than a decade of forum activity, shared email addresses, Telegram identifiers, and records exposed in a 2025 breach of Russia's Gosuslugi government services platform.
- Qilin actively recruits English-speaking affiliates and has claimed association with groups including Scattered Spider and RansomHub, broadening its threat surface considerably.
- The case illustrates how persistent reuse of handles, email addresses, and contact details across criminal forums creates durable attribution threads, regardless of periodic identity changes.
The scale of the Qilin operation
Qilin has claimed responsibility for attacks on at least 365 organisations in the past three months alone, placing it at the top of a field that shows no sign of contracting. The group operates as a ransomware-as-a-service affiliate program, offering partners at least 80 percent of any ransom paid by victims. It also practices double extortion: stealing data before encrypting systems, then threatening to publish it if payment is not made. That combination of generous affiliate terms and aggressive data theft has made Qilin a significant and growing threat.
A wider recruitment net than most
Most ransomware groups operating out of Russia limit their affiliate pool to Russian-speaking criminals, partly to avoid drawing the attention of domestic law enforcement. Qilin takes a different approach. Its administrator has stated publicly, via Telegram, that the group works with English-speaking affiliates and has claimed associations with Scattered Spider and RansomHub. That willingness to work across language and geography makes Qilin a more expansive threat than its peers and complicates the jurisdictional picture for investigators.
How the administrator was identified
The person believed to run Qilin operates under the handle Haise, but that is not the identity they started with. Forum records indexed by Intel 471 show that in 2022, Haise applied for membership to RAMP, a closely controlled Russian cybercrime forum later seized by the FBI in January 2026. During that application process, the RAMP administrator referenced the applicant's Telegram username: Alexbigboss44. That username connects back to the handle Rjun, used on Russian cybercrime forums Exploit and XSS as early as 2020. Rjun registered across multiple forums using the email address mail-30a@mail.ru, and that address subsequently appeared in leaked records from Gosuslugi, Russia's official digital services platform, which was breached in late 2025 and reportedly exposed more than 20 million records. Those records associate the email address with Aleksey Mikhailovich Yakovtsev, aged 36, of St. Petersburg.
Corroborating threads
The connection is reinforced by several independent data points. SpyCloud found the email address mail-30a@mail.ru was used with the password Rjun132, a clear echo of the forum handle. A Telegram account with the user ID 118329521, long associated with Haise, is linked via Constella Intelligence to a Russian mobile number connected to email addresses bearing variations of the Rjun and Yakovtsev names. That mobile number belongs to Yakovtsev's biological sister, and records suggest he used her contact details when registering at various websites. Russian education authority records show a person of that name attended school in Murmansk and holds a master's degree in computing and information systems. Attribution firm IntelHawk, which conducted initial work connecting these identities, describes a progression from low-level credit card fraud and traffic arbitrage in 2018 and 2019 to the organisation of complex cybercrime activities from 2020 onwards.
The opsec lesson embedded in the story
The attribution case is a practical illustration of how operational security failures compound over time. Changing forum handles is a sound practice, but it provides little protection if the same email address, Telegram account, or phone number threads through multiple identities over years. Leaked government databases, hacked forum archives, and commercial intelligence platforms can reconstruct those threads long after the fact. For security professionals tracking threat actors, this case confirms the value of correlating historical forum data with breach intelligence and national database exposures.
Why it matters
Qilin is the most active ransomware affiliate program operating today, and its willingness to recruit English-speaking affiliates means Australian and other Western organisations are firmly within its targeting scope. CISOs should treat Qilin as an active and credible threat rather than a distant Russian-language criminal enterprise. The group's double extortion model means that even organisations with mature backup and recovery capabilities face serious data exposure risk. The attribution research also carries a broader lesson: threat intelligence built on correlated forum, breach, and government data is maturing rapidly, and the same infrastructure used to attribute threat actors can help security teams understand which criminal networks their adversaries are connected to.
What to do now
- Review exposure to Qilin's known tactics: initial access via compromised credentials and phishing, followed by data exfiltration before encryption. Ensure detection controls address both phases, not just the encryption event.
- Given Qilin's association with English-speaking affiliates including Scattered Spider, reinforce controls against social engineering and SIM-swapping attacks targeting help desk and identity management staff.
- Assess whether sensitive data stores could be exfiltrated without triggering existing alerts. Double extortion is effective precisely because organisations often have no visibility into what was taken before ransomware executes.
- Brief relevant staff on the Qilin affiliate model: a broad pool of affiliates means attack techniques and entry vectors will vary. Generic ransomware defences need to be supplemented with identity and access monitoring.
- If your organisation uses commercial cyber threat intelligence platforms, ensure Qilin and associated identifiers are actively monitored. The RAMP forum seizure and ongoing attribution work may surface new indicators.
