Brian Krebs reported Wednesday that the ransomware-as-a-service group Qilin is the most active affiliate program of its kind and that its administrator can be tied, through forum and leaked-record trails, to a 36-year-old man in St. Petersburg, Russia¹.

Krebs said Qilin has operated since September 2022 and has claimed at least 365 victim organizations in the past three months¹. He cited an NCC Group quarterly threat report this month ranking Qilin as the most industrious ransomware-as-a-service gang¹.

The group recruits affiliates by offering them at least 80 percent of any ransom paid, Krebs wrote, and uses a double-extortion model: stealing data, encrypting systems and threatening to publish files¹. Unlike many Russia-based programs, he said, Qilin works with English-speaking affiliates, and its leader has said on Telegram that the group has worked with Scattered Spider and RansomHub¹.

Krebs identified the administrator's current handle as Haise¹. He said Intel 471 records show that in June 2022 Haise applied to the Russian ransomware forum RAMP, which the FBI seized in January 2026, and that a RAMP administrator approved the account while referring to the Telegram username Alexbigboss44¹.

That Telegram name, Krebs wrote, was used in 2020 by a user called Rjun on the Exploit and XSS forums¹. Flashpoint, an advertiser on Krebs's site, described Alexbigboss44 as a prolific trader of traffic, logs and corporate access, including Facebook logs and Google Ads accounts used in fraudulent advertising and gambling schemes¹. IntelHawk, which Krebs said shared the Haise-Rjun link privately, described a progression from carding and ad arbitrage in 2018-2019 toward malware, botnets and payment infrastructure¹.

Intel 471 found Rjun registered at Darkmarket, Verified and Zloy with the email [email protected], Krebs reported¹. SpyCloud, also an advertiser on the blog, associated that address with the password Rjun132¹. Constella Intelligence showed the same email in records from gosuslugi.ru, Russia's state services portal, which Krebs said was breached in late 2025 with more than 20 million records¹.

According to those leaked records as described by Krebs, the address belongs to Aleksey Mikhailovich Yakovtsev of St. Petersburg¹. Krebs said Russian education records list a master's degree in computing and information systems and schooling in Murmansk, and that a Telegram account ID long used by Haise is linked to a phone number that Constella tied to emails including [email protected] and [email protected]¹. He said IntelHawk attributed that number to Yakovtsev's sister and that flight records show travel between St. Petersburg and Murmansk in 2013-2014 and later trips to Sochi, with no flights outside Russia¹.

Krebs said attempts to reach Yakovtsev by email and phone were unsuccessful¹. An anonymous account, Gang Exposed, reached similar conclusions in a write-up Krebs linked, crediting IntelHawk¹. The identification rests on commercial intelligence platforms, leaked databases and handle reuse; no law-enforcement charging document is cited in the report¹.