Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe
Qilin ransomware administrator identified as Russian hacker Aleksey Mikhailovich Yakovtsev.
A cybercrime investigation has identified Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian national residing in St. Petersburg, as the administrator of the Qilin ransomware operation. The findings, published by KrebsOnSecurity, link the online identity "Haise" to Yakovtsev through a chain of reused identities, forum accounts, Telegram records, and leaked databases. Qilin, operating as a ransomware-as-a-service program since September 2022, has claimed at least 365 victim organizations.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe identification of Qilin's administrator relied heavily on reused online identities, forum accounts, Telegram records, and leaked databases — operational security failures that ultimately exposed a threat actor responsible for 365 known ransomware victims. This case illustrates how persistent digital footprints, even from years-old forum activity, can be correlated to unmask cybercriminals. For defenders, it reinforces that ransomware groups are run by real, traceable individuals — and that strong threat intelligence and attribution work does yield results. Organizations victimized by Qilin-affiliated affiliates should recognize that law enforcement and investigative journalism can support incident response and potential recovery efforts.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Qilin