[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3L4oS38MWl3KG6eJ5BMG5EbptYNZKd8vjgPRp7i5IVo":3},{"article":4,"iocs":46,"watch_terms":49,"solutions":50,"lesson":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"a83be0f8-faaf-47f0-a279-b17b1db56d1d","Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe","qilin-ransomware-admin-identified-as-36-year-old-russian-hacker-after-cybercrime-cabe1b","A cybercrime investigation has linked the administrator of Qilin ransomware to Aleksey Mikhailovich Yakovtsev, a 36-year-old man living in St. Petersburg, Russia. Published by KrebsOnSecurity on November 11, 2026, the findings connect the online identity “Haise” to older forum accounts, Telegram records, and leaked databases. The identification remains a research finding, not a court ruling […] The post Qilin Ransomware Admin Identified as 36-Year-Old Russian Hacker After Cybercrime Probe appeared first on Cyber Security News.","A cybercrime investigation has identified Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian national residing in St. Petersburg, as the administrator of the Qilin ransomware operation. The findings, published by KrebsOnSecurity, link the online identity \"Haise\" to Yakovtsev through a chain of reused identities, forum accounts, Telegram records, and leaked databases. Qilin, operating as a ransomware-as-a-service program since September 2022, has claimed at least 365 victim organizations.","Qilin ransomware administrator identified as Russian hacker Aleksey Mikhailovich Yakovtsev.","https:\u002F\u002Fcybersecuritynews.com\u002Fqilin-ransomware-admin-identified\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FQilin-Ransomware-Administrator-Identified-as-Suspected-36-Year-Old-Russian-Hacker-Following-Major-Cybercrime-Investigation.webp","2026-11-12T13:42:39+00:00","2026-11-12T14:00:25.537858+00:00",8,[17,20,22,24,26],{"name":18,"type":19},"Qilin","threat_actor",{"name":21,"type":19},"Haise",{"name":23,"type":19},"Alexbigboss44",{"name":25,"type":19},"Rjun",{"name":27,"type":19},"Aleksey Mikhailovich Yakovtsev","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},[47],{"type":43,"value":18,"context":48},"Ransomware operation",[],{"controls":51,"vendors":52},[],[],{"slug":54,"title":55,"body":56,"framework_refs":57,"framework_notes":63},"qilin-raas-admin-unmasked-through-reused-digital-identities","Qilin RaaS Admin Unmasked Through Reused Digital Identities","The identification of Qilin's administrator relied heavily on reused online identities, forum accounts, Telegram records, and leaked databases — operational security failures that ultimately exposed a threat actor responsible for 365 known ransomware victims. This case illustrates how persistent digital footprints, even from years-old forum activity, can be correlated to unmask cybercriminals. For defenders, it reinforces that ransomware groups are run by real, traceable individuals — and that strong threat intelligence and attribution work does yield results. Organizations victimized by Qilin-affiliated affiliates should recognize that law enforcement and investigative journalism can support incident response and potential recovery efforts.",[58,59,60,61,62],"NIST CSF 2.0 RS.AN-03: Incident Analysis","NIST SP 800-53 IR-6: Incident Reporting","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","MITRE ATT&CK G0106: Qilin",{"NIS2 Article 21(2)(b)":64,"MITRE ATT&CK G0106: Qilin":65,"NIST SP 800-53 IR-6: Incident Reporting":66,"NIST CSF 2.0 RS.AN-03: Incident Analysis":67,"CIS Control 17: Incident Response Management":68},"NIS2 requires incident handling procedures that include notification obligations, and consistent cross-border incident reporting of Qilin attacks contributed to the investigation that identified the RaaS administrator.","Tracking adversary group profiles, TTPs, and infrastructure under ATT&CK enables defenders and investigators to correlate campaigns to specific threat actors, as was done to attribute Qilin activity to Yakovtsev.","This control requires timely reporting of security incidents to authorities, which aggregates victim data and supports the cross-organizational attribution work that exposed Yakovtsev.","This category requires organizations to analyze incidents thoroughly, including preserving evidence and understanding attacker tactics — the same investigative rigor that enabled attribution of Qilin's administrator.","This control mandates establishing and maintaining an incident response capability, including coordination with law enforcement, which is central to the investigative chain that identified Qilin's operator."]