An extensive cybercrime investigation has reportedly identified the person behind the Qilin ransomware as Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of St. Petersburg, Russia. This connection was outlined in a report by KrebsOnSecurity on November 11, 2026, which associated the online pseudonym ‘Haise’ with older forum accounts, Telegram communications, and leaked databases. However, these findings are based on research and have not led to any formal charges or legal proceedings.
Tracing the Cybercrime Trail
The discovery comes amid reports of Qilin targeting approximately 365 organizations over a span of three months. As per the NCC Group, this ransomware operation is one of the most active affiliate programs globally. These figures reflect claimed incidents rather than independently verified breaches.
Investigators followed a trail of reused identities. Records from Intel 471, referenced by Krebs, indicated that ‘Haise’ applied to join the Russian cybercriminal forum RAMP in June 2022. Correspondence between the forum’s administrator and the applicant revealed the use of both ‘Haise’ and the Telegram handle ‘Alexbigboss44’.
Connecting the Dots
Further research linked the Telegram username ‘Alexbigboss44’ to posts made in 2020 on the Exploit and XSS forums by another user named ‘Rjun’. These connections established a continuity of identity that predated Qilin’s rise as a significant threat. Flashpoint described ‘Alexbigboss44’ as being active in trading stolen data, online traffic, and corporate access.
IntelHawk played a crucial role in piecing together these identities through historical usernames and other indicators. Leo Bogod, the founder, highlighted a shift from small-scale fraud in 2018-2019 to more coordinated activities involving malware and botnets from 2020 to 2023.
Ransomware Operations and Implications
The research also uncovered an email address used to register ‘Rjun’ accounts across various forums. SpyCloud detected a historical password associated with this alias, and Constella Intelligence linked the email to leaked records from Russia’s Gosuslugi platform, identifying Yakovtsev.
Further validation came from persistent Telegram account identifiers and related contact records, with Flashpoint documenting over 5,000 messages linked to this identity since 2018. Despite attempts, Krebs was unable to obtain comments from Yakovtsev regarding these findings.
Qilin operates as a ransomware-as-a-service platform, where affiliates infiltrate networks, deploy ransomware, and share up to 80% of ransom payments. The group employs a double extortion tactic by stealing and threatening to release sensitive data before encryption.
Despite the revelations, the investigation underscores a vulnerability in prolonged criminal activities: changing aliases cannot erase historical links. Persistent contact details enable researchers to connect identities over time, although these associations do not confirm guilt or impact Qilin’s ongoing threats.
