A cybercrime investigation published by KrebsOnSecurity on November 11, 2026 claims to have identified the administrator behind Qilin, one of the most prolific ransomware-as-a-service operations currently active. The report connects the online persona “Haise” to Aleksey Mikhailovich Yakovtsev, a 36-year-old man based in St. Petersburg, Russia. It’s worth stating plainly: this is a research attribution, not a criminal charge or court finding, and Yakovtsev has not been formally accused by any prosecuting authority.

The timing is notable. Citing figures from NCC Group, the report describes Qilin as having claimed at least 365 victim organizations over just three months, a pace that reportedly makes it the most active ransomware affiliate program currently tracked. Those numbers reflect claims made by the group itself rather than independently confirmed breach counts, but even discounted, they point to an operation running at significant scale.

A Trail Built From Years of Reused Usernames

Rather than a single smoking-gun document, the attribution rests on connecting a chain of online identities used across different forums and years. According to Intel 471 records cited in the report, the “Haise” persona applied to join the Russian-language cybercrime forum RAMP in June 2022. Private messages reportedly showed the forum’s administrator referring to the applicant by both the Haise handle and a Telegram username, “Alexbigboss44.”

That same Telegram username had surfaced years earlier, in 2020, in posts made under a different alias, “Rjun,” on the Exploit and XSS cybercrime forums — two of the most established Russian-language marketplaces for stolen data and criminal tooling. Flashpoint researchers described the Alexbigboss44 identity as a frequent buyer and seller of stolen account credentials, traffic and corporate network access, consistent with someone building toward a more organized criminal enterprise.

From Forum Handles to a Real Name

The investigation credits a research group called IntelHawk, founded by Leo Bogod, with piecing together a broader timeline: small-scale fraud activity in 2018 and 2019 escalating into more organized work involving malware, botnets and payment fraud between 2020 and 2023. The next link in the chain came through an email address used to register accounts under the “Rjun” alias. Threat-intelligence firm SpyCloud reportedly found a historical leaked password tied to that email which itself contained the Rjun alias — and Constella Intelligence traced the same email to records leaked from Gosuslugi, Russia’s government services portal, which the report says ultimately pointed to Yakovtsev’s identity.

Additional corroborating signals cited in the investigation include a persistent Telegram account identifier, associated contact records and leaked travel data. Flashpoint says it has logged more than 5,000 messages tied to that Telegram identity dating back to 2018. Krebs reported that attempts to reach Yakovtsev directly for comment went unanswered.

How Qilin Operates

Active since September 2022, Qilin runs a ransomware-as-a-service model in which affiliates handle the actual network intrusions and ransomware deployment in exchange for at least 80 percent of any ransom collected. Like most modern ransomware operations, Qilin relies on double extortion — stealing sensitive data before encrypting systems, then threatening to publish it if the victim doesn’t pay.

• Qilin affiliates have specifically targeted VMware vCenter and ESXi environments, using remote management tools and vulnerable drivers to disable security products before deploying ransomware across virtualized infrastructure.
• The group has reportedly relied on bulletproof hosting providers to keep its extortion infrastructure online despite abuse complaints and takedown attempts.
• Targeting virtualization management layers lets a single compromise cascade across many business systems at once, which helps explain the group’s victim-count claims.

Attribution Isn’t the Same as Disruption

The investigation underscores a recurring theme in cybercrime research: changing a username doesn’t erase the connections built up around older accounts. Reused email addresses, Telegram identifiers and leaked credential databases can tie a years-old forum post to a present-day ransomware operation. But as the report itself cautions, identifying a suspected administrator doesn’t equate to proof of guilt, and it doesn’t mean Qilin’s operations have stopped or that current and future victims face reduced risk. Organizations, particularly those running VMware infrastructure, should treat this as a reminder to keep hypervisor-layer defenses and offline backups current rather than a sign that the threat has passed.