Krebs on Security Links Qilin Administrator to Named St. Petersburg Man

Krebs on Security reports that Qilin has become the most active ransomware-as-a-service group, claiming at least 365 victim organizations in the past three months, according to a report by the cybersecurity firm NCC Group. The group offers affiliates at least 80 percent of any extortion amount paid by victims and uses the double extortion model.

The article traces the administrator, who uses the handle Haise, to earlier accounts on the cybercrime forum RAMP and on Russian forums. It credits Intel 471, Flashpoint, Spycloud and Constella Intelligence with data points, and IntelHawk with a private analysis that links these identities to Aleksey Mikhailovich Yakovtsev, 36, of St. Petersburg. Krebs on Security reports that attempts to reach Mr. Yakovtsev by email and phone were unsuccessful.

למה זה חשוב For security leaders, the account shows how ransomware affiliate programs are linked to individuals through reused handles, forum registrations and leaked personal records. Investigators can treat the chain as a method: historical usernames, shared email addresses and breached databases can connect a current administrator to older identities. The attribution rests on third-party analysis and has not been confirmed by a court or a law enforcement agency in the article, so it should be verified before it informs any action.