KrebsOnSecurity identified the administrator of the Qilin ransomware operation, who uses the handle Haise, as a 36-year-old man from St. Petersburg named Aleksey Mikhailovich Yakovtsev. The identification, published on November 11, rests on data from Intel 471, Flashpoint and IntelHawk. It is a researcher claim, and no charges have been announced.
Who the Researchers Say Haise Is
Cybernews, which also covered the report, adds that the man holds a master’s degree in computing and information systems. Neither outlet reports a law-enforcement statement, and officials have taken no public action.
The RAMP Forum Application and Telegram Link
The researchers trace the identification to June 2022, when the user applied to the RAMP forum. The FBI seized RAMP in January 2026. Direct messages from RAMP, indexed by Intel 471, show the Qilin administrator referring to Haise by the Telegram username Alexbigboss44.
Matching Accounts on Exploit and XSS
That Telegram username matched a user called Rjun on the Exploit and XSS forums. According to the reporting, Rjun was active in Facebook-log and Google Ads account fraud and in credit-card fraud. The connection between those fraud activities and the ransomware role forms the core of the attribution.
Qilin’s Standing Among Ransomware Programs
Qilin has operated since September 2022. Reporting describes it as the most active ransomware affiliate program, with at least 365 victims in three months, according to a report this month from NCC Group.
Affiliate Terms and Extortion Model
Affiliates keep at least 80 percent of any ransom, and the group uses double extortion. Qilin has worked with English-speaking groups and claims links to Scattered Spider and RansomHub.
Prior Law-Enforcement Action Against a Qilin Member
Cybernews reports that last October Japanese police arrested an alleged Qilin member, who was then extradited to Germany. That arrest targeted a member of the operation rather than its administrator.
Limits of the Attribution to Aleksey Yakovtsev
The identification relies on forum records and account links rather than a court filing or official indictment. The sources describe the findings as researcher claims, and the reports do not include a response from the named man. KrebsOnSecurity and Cybernews present the evidence chain as a series of matches: a RAMP application, a Telegram username in indexed messages, and a forum identity tied to fraud.
The reports note that identifying a leader of a top ransomware program is rare. They also note that actors based in Russia are rarely extradited, which limits what an identification can achieve in legal terms. No law-enforcement statement had appeared as of November 12.
The disclosure arrives while Qilin is the most active affiliate program by the NCC Group measure. A named administrator does not by itself affect the group’s operations, and the reports do not suggest any change to Qilin’s activity. The research adds to a small body of public attributions that connect ransomware leaders to earlier cybercrime forum histories, in this case a path that runs from a seized forum to a payment-fraud identity.
Sources Behind the Qilin Identification
KrebsOnSecurity published the identification on November 11, and Cybernews followed with its own coverage. The reports draw on Intel 471, Flashpoint and IntelHawk data, and neither names a law-enforcement agency as a source.
The affiliate model described in the reports lets Qilin recruit operators who keep at least 80 percent of each ransom. That split, combined with the 365 victims counted by NCC Group over three months, explains why the program draws attention in threat-intelligence reporting.
The claims in both reports remain unproven in court. The reports describe a chain of matching usernames and forum identities, and they note that the identification has produced no announced charges. The only law-enforcement action cited is the October arrest in Japan of an alleged Qilin member who was extradited to Germany, which concerns a different individual.
