The landscape of global ransomware has reached a fever pitch, with the cybercrime collective known as Qilin currently reigning as the most prolific ransomware-as-a-service (RaaS) operation on the planet. According to a recent threat intelligence report from the cybersecurity firm NCC Group, Qilin has claimed at least 365 victim organizations in just the last three months. Yet, for all its technical sophistication and industrial-scale extortion, the group’s leadership has proven vulnerable to the oldest weakness in the digital underworld: a trail of broken operational security (opsec) breadcrumbs. An extensive investigation into the digital footprint of the group’s administrator, known by the handle "Haise," has now stripped away the veil of anonymity, pointing directly to a 36-year-old man residing in St. Petersburg, Russia.
Qilin, which has been operational since September 2022, has cemented its status as the most industrious gang in the RaaS ecosystem. Its business model is designed to maximize damage and revenue through the "double extortion" tactic—not only encrypting a victim’s digital infrastructure but also exfiltrating sensitive data to use as leverage, threatening to publish the information online if the ransom remains unpaid. Unlike many of its counterparts in the Russian cybercrime sphere, which often prioritize nationalistic silos, Qilin has aggressively recruited English-speaking affiliates. Its leadership has even boasted on Telegram of strategic collaborations with other notorious entities, including the high-profile hacking group Scattered Spider and the ransomware syndicate RansomHub. By offering affiliates a lucrative 80 percent cut of any successful extortion, Qilin has rapidly scaled its operations to unprecedented levels.
However, the path to identifying the man behind the mask involves a complex web of overlapping digital identities that span nearly a decade. The administrator currently known as "Haise" did not always carry that moniker. In the world of high-stakes cybercrime, rotating handles is a standard defensive maneuver intended to distance a current, high-profile identity from the mistakes of a younger, less cautious past. Despite these precautions, the necessity of establishing credentials on new, exclusive forums often forces operators to reference or reuse old accounts. When those forums are eventually compromised by law enforcement or rival hackers, those historical links become fatal to the perpetrator’s anonymity.
The unraveling of Haise’s identity began with the cyber intelligence platform Intel 471, which tracked the user’s application to RAMP in June 2022. RAMP was a highly exclusive Russian-language forum designed specifically as a sanctuary for ransomware affiliate programs, functioning as a "walled garden" for the industry’s most dangerous actors. When the FBI seized RAMP in January 2026, it provided a treasure trove of direct messages that confirmed the RAMP administrator had approved the application for "Haise," explicitly linking that handle to a specific Telegram username: "Alexbigboss44."
This connection served as the primary anchor for further investigation. A cross-reference search for the Telegram handle "Alexbigboss44" revealed that the account had been used by an individual operating under the handle "Rjun" on prominent Russian cybercrime forums such as Exploit and XSS as early as 2020. Further analysis from the cyber intelligence firm Flashpoint—which tracks the illicit trade of traffic, logs, and corporate access—revealed that the user behind these accounts was a veteran of the criminal underground. Long before the rise of Qilin, this individual was deeply involved in the high-volume acquisition of Facebook logs and Google Ads accounts, facilitating large-scale fraudulent advertising and gambling operations. During this period, the user functioned as a broker, managing networks of traffickers and purchasing compromised credentials to fuel their criminal enterprises.
The convergence of these identities was further substantiated by IntelHawk, an AI-driven platform that specializes in de-anonymizing threat actors by analyzing historical usernames, linguistic stylometry, and other metadata. Leo Bogod, founder and chief technology officer of IntelHawk, noted that the progression of these digital identities reveals a clear trajectory. The data shows a evolution from a novice arbitrageur and credit card fraudster between 2018 and 2019 to a sophisticated, experienced organizer of complex cyber-offensives between 2020 and 2023, with an increasing focus on malware, botnets, and the creation of resilient payment infrastructure.
The digital paper trail deepened when Intel 471 identified that the "Rjun" identity had been a long-standing member of other notorious Russian forums, including Darkmarket, Verified, and Zloy. In every instance, the account was registered using the email address "[email protected]." The identity threat protection firm Spycloud discovered that this specific email account had been secured with the password "Rjun132," a glaring lapse in security that allowed researchers to trace the account across various data breaches. When queried through the breach-tracking service Constella Intelligence, the email address was found in records associated with gosuslugi.ru, the official digital portal for state and municipal services in the Russian Federation.
The breach of the Gosuslugi platform in late 2025, which reportedly exposed more than 20 million records containing full names, birth dates, and mobile numbers, proved to be the final piece of the puzzle. According to the leaked data, the email account [email protected] was registered to a 36-year-old resident of St. Petersburg named Aleksey Mikhailovich Yakovtsev.
Corroborating evidence from Flashpoint further solidified this conclusion. The Telegram account used by Haise, which possessed the user ID 118329521, had recorded more than 5,000 messages since 2018. When this ID was searched in breach databases, it was found to be linked to the Russian phone number +79602347275. Pivoting on this phone number uncovered two additional email addresses—[email protected] and [email protected]—effectively linking the Qilin administrator’s modern persona to the older Rjun identity.
Records from Rosobrnadzor, Russia’s education watchdog, provided additional biographical depth, confirming that an Aleksey Yakovtsev had attended grade school in Murmansk and held a master’s degree in computing and information systems. IntelHawk’s analysis suggested that the phone number +79602347275 actually belongs to Yakovtsev’s biological sister, and that the suspect frequently utilized his sister’s contact information when registering for various web services, a common practice among those attempting to obscure their primary digital footprint.
Further validation of the identity came from Russian travel agency data, which had also suffered breaches. Flight records associated with the phone number show that Aleksey Yakovtsev, born August 18, 1990, traveled between St. Petersburg and Murmansk multiple times between 2013 and 2014. More recent records indicate that while Yakovtsev has not traveled internationally, he is a frequent flyer between St. Petersburg and the resort city of Sochi, located on the Black Sea coast.
The findings have been echoed by independent investigators, including the anonymous "Gang Exposed" account on X (formerly Twitter), which has successfully de-anonymized numerous ransomware actors in the past. They reached conclusions nearly identical to those of the cybersecurity firms, citing IntelHawk’s analytical platform as the catalyst for connecting the final points of the investigation. Despite the overwhelming evidence pointing to his role in overseeing the world’s most active ransomware syndicate, attempts to reach Mr. Yakovtsev for comment via his known email addresses and phone numbers have been unsuccessful. The case serves as a stark reminder that even the most meticulous cybercriminals, operating from the relative safety of the Russian Federation, are rarely as invisible as they believe themselves to be.
