Qilin ransomware administrator "Haise" allegedly identified as Aleksey Yakovtsev of St. Petersburg, Russia
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 12/11/2026 12:00; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ krebsonsecurity.com ↗
Reporting published on 2026-11-11 by KrebsOnSecurity (krebsonsecurity.com) alleges that the administrator of the Qilin ransomware-as-a-service (RaaS) program, known as "Haise", is likely Aleksey Mikhailovich Yakovtsev, a 36-year-old man from St. Petersburg, Russia. Qilin has been active since September 2022 and uses a double extortion model against organizations worldwide. The sources say it claimed more than 365 victims in roughly three months (krebsonsecurity.com, gbhackers.com). On 2026-11-12 gbhackers.com summarized the investigation and stressed that this is an allegation with no judicial confirmation. Yakovtsev did not respond to attempts to contact him for comment (krebsonsecurity.com).
Detalhes técnicos
- Attribution method: The identification links several underground personas to one real-world identity through forum memberships, compromised account data, and personal identifiers in leaked Russian government records. The handles include "Rjun" and the Telegram user "Alexbigboss44" (krebsonsecurity.com, gbhackers.com).
- Profile of the suspect: He holds a master's degree in computing and information systems and has a history of cybercrime-related trafficking and fraud (krebsonsecurity.com).
- Business model: Qilin is a RaaS program that works with English-speaking affiliates and other ransomware gangs (krebsonsecurity.com). Affiliates reportedly receive at least 80% of ransom proceeds, which has helped recruitment and growth (gbhackers.com).
- Affiliate tradecraft: Reported techniques include compromised VPN credentials, credential theft, lateral movement, and cloud-based exfiltration (gbhackers.com).
Remediação
The sources give no remediation guidance. Based on the techniques they list, defenders should prioritize protecting VPN access and credentials, detecting credential theft and lateral movement, and monitoring for exfiltration to cloud services.
Relatos divergentes
- Qilin's ranking: krebsonsecurity.com calls Qilin the world's most active ransomware affiliate program. gbhackers.com, the later and secondary source, says only that it is one of the most active.
- Certainty of attribution: krebsonsecurity.com, the original research, says Yakovtsev is "likely" Haise. gbhackers.com calls the identification an allegation without judicial confirmation. Treat the identity as unconfirmed.
Linha do tempo
-
Administrator of Qilin Ransomware Gang Allegedly Identified as Aleksey Mikhailovich Yakovtsev
ler a análise desta fonte ocultar
An investigative report by KrebsOnSecurity identifies Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian from St. Petersburg, as the alleged administrator behind the Qilin ransomware gang. Qilin has been active since September 2022 and is described as one of the most active ransomware affiliate programs, claiming at least 365 victim organizations over three months recently. The group utilizes double extortion tactics and offers affiliates at least 80% of ransom proceeds, contributing to its rapid expansion and recruitment. The attribution to Yakovtsev is based on linking his real-world identity to multiple underground personas through forum accounts, Telegram identifiers, leaked records, and breached data, although it remains an allegation without judicial confirmation. Qilin affiliates employ techniques including compromised VPN credentials, credential theft, lateral movement, and cloud-based exfiltration.
-
Qilin Ransomware Affiliate Program Administrator Identified as Aleksey Yakovtsev in Russia
ler a análise desta fonte ocultar
The ransomware group Qilin, active since September 2022 and operating a ransomware-as-a-service (RaaS) model, has become the world's most active ransomware affiliate program with over 365 victims in three months. The group, based in Russia and led by the administrator known as "Haise," uses a double extortion model targeting organizations globally. Cyber intelligence research has uncovered that "Haise" is likely Aleksey Mikhailovich Yakovtsev, a 36-year-old man from St. Petersburg, Russia. This conclusion is based on linking multiple cybercriminal handles and accounts, including “Rjun” and Telegram user "Alexbigboss44," through forum memberships, compromised account data, and personal identifiers found in leaked Russian government records. Yakovtsev has a master's degree in computing and information systems and a history in cybercrime-related trafficking and fraud activities. The Qilin group notably collaborates with English-speaking affiliates and other ransomware gangs. Attempts to contact Yakovtsev for comment were unsuccessful.