The main administrator of Qilin, the most prolific ransomware-as-a-service (RaaS) gang today, is Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian citizen residing in Saint Petersburg.
This is revealed by an investigation published by cybersecurity journalist Brian Krebs, who has managed to reconstruct the digital trail of the ringleader—known on the dark web under the pseudonym Haise—thanks to a series of accumulated oversights over the past decade.
With at least 365 claimed victim organizations in the last three months, Qilin has established itself as the most active extortion affiliate program on the planet, according to a recent report by the firm NCC Group.
Operational since September 2022, the gang offers its collaborators at least 80% of the ransoms obtained through the double extortion model and, unlike other Russian groups, openly collaborates with English-speaking affiliates from gangs like Scattered Spider or RansomHub.
Haise’s fall into anonymity began in June 2022, when he requested access to the exclusive Russian underground forum RAMP—intervened by the FBI in January 2026—using his Telegram account ‘Alexbigboss44’.
Records from intelligence platforms like Intel 471 and Flashpoint show that the same user operated since 2020 in forums like Exploit and XSS under the alias Rjun, engaging in the illicit trafficking of corporate access, credit card fraud, and the buying and selling of fraudulent Facebook and Google Ads advertising accounts.
The data cross-referencing conducted through the IntelHawk artificial intelligence platform allowed tracking Rjun’s records in forums like Darkmarket, Verified, and Zloy, where he registered with the email mail-30a@mail.ru and the password Rjun132.
That same email address later appeared among the more than 20 million records exposed after the security breach suffered at the end of 2025 by Gosuslugi, the official portal of Russian state public services, directly linking the account with the full name, date of birth (August 18, 1990), and Yakovtsev’s residence in Saint Petersburg.
The attribution was confirmed by cross-referencing the numerical identifier of his historical Telegram account with a Russian phone number registered in the name of his biological sister, whose alternate emails he also used to sign up for various services.
According to records from the Russian educational regulator Rosobrnadzor and leaked airline databases, Yakovtsev attended primary school in Murmansk, holds a master’s degree in computer science and information systems, and although he does not have recent international flights, he frequently travels between Saint Petersburg and the resort town of Sochi on the Black Sea coast.
The need for reputation has played against him
The attribution—also supported by the specialized collective GangExposed—comes after a meticulous tracking that IntelHawk founder Leo Bogod describes as “a progression from a novice credit card scammer in 2018-2019 to an organizer of complex cybercriminal activities between 2020 and 2023.”
Although Yakovtsev has remained silent in response to contact attempts, his history confirms what Krebs warns about identity change on the dark web: no matter how much a criminal tries to erase their trail, “sometimes they have to reference their old pseudonyms to be accepted into a new forum,” leaving a breadcrumb that sooner or later ends up being seized.
The main administrator of Qilin, the most prolific ransomware-as-a-service (RaaS) gang today, is Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian citizen residing in Saint Petersburg.
This is revealed by an investigation published by cybersecurity journalist Brian Krebs, who has managed to reconstruct the digital trail of the ringleader—known on the dark web under the pseudonym Haise—thanks to a series of accumulated oversights over the past decade.
With at least 365 claimed victim organizations in the last three months, Qilin has established itself as the most active extortion affiliate program on the planet, according to a recent report by the firm NCC Group.
Operational since September 2022, the gang offers its collaborators at least 80% of the ransoms obtained through the double extortion model and, unlike other Russian groups, openly collaborates with English-speaking affiliates from gangs like Scattered Spider or RansomHub.
Haise’s fall into anonymity began in June 2022, when he requested access to the exclusive Russian underground forum RAMP—intervened by the FBI in January 2026—using his Telegram account ‘Alexbigboss44’.
Records from intelligence platforms like Intel 471 and Flashpoint show that the same user operated since 2020 in forums like Exploit and XSS under the alias Rjun, engaging in the illicit trafficking of corporate access, credit card fraud, and the buying and selling of fraudulent Facebook and Google Ads advertising accounts.
The data cross-referencing conducted through the IntelHawk artificial intelligence platform allowed tracking Rjun’s records in forums like Darkmarket, Verified, and Zloy, where he registered with the email mail-30a@mail.ru and the password Rjun132.
That same email address later appeared among the more than 20 million records exposed after the security breach suffered at the end of 2025 by Gosuslugi, the official portal of Russian state public services, directly linking the account with the full name, date of birth (August 18, 1990), and Yakovtsev’s residence in Saint Petersburg.
The attribution was confirmed by cross-referencing the numerical identifier of his historical Telegram account with a Russian phone number registered in the name of his biological sister, whose alternate emails he also used to sign up for various services.
According to records from the Russian educational regulator Rosobrnadzor and leaked airline databases, Yakovtsev attended primary school in Murmansk, holds a master’s degree in computer science and information systems, and although he does not have recent international flights, he frequently travels between Saint Petersburg and the resort town of Sochi on the Black Sea coast.
The need for reputation has played against him
The attribution—also supported by the specialized collective GangExposed—comes after a meticulous tracking that IntelHawk founder Leo Bogod describes as “a progression from a novice credit card scammer in 2018-2019 to an organizer of complex cybercriminal activities between 2020 and 2023.”
Although Yakovtsev has remained silent in response to contact attempts, his history confirms what Krebs warns about identity change on the dark web: no matter how much a criminal tries to erase their trail, “sometimes they have to reference their old pseudonyms to be accepted into a new forum,” leaving a breadcrumb that sooner or later ends up being seized.
Become a premium member for free!
——————————————————–
Click Here For The Original Source.
