Cybersecurity Experts Unmask Alleged Qilin Ransomware Administrator, Tracing Him to St. Petersburg

Alexey Mikhailovich Yakovtsev lives in St. Petersburg. He holds a master’s degree in computer engineering and information systems. He was previously involved in credit card fraud and, according to researchers, now leads Qilin, one of the world’s most notorious cybercriminal groups.

The Russia-based ransomware group Qilin is considered one of the most successful Ransomware-as-a-Service (RaaS) operators in the world. In the past three months alone, it has claimed responsibility for attacks on at least 365 organizations. Qilin and its affiliates, who are typically offered around 80% of the ransom payments collected from victims, generally use a double-extortion model. Attackers first steal sensitive data and then encrypt the affected organizations’ systems.

Key Mistakes Helped Unmask the Administrator

As cyberattacks cause enormous financial losses for companies and organizations, investigators around the world are actively searching for Qilin members. However, their efforts have so far achieved limited success.

In October last year, Japanese police arrested a suspected Qilin member and extradited him to Germany. However, most members of the group are based in Russia, and since Moscow actively uses hackers to advance its own interests, obtaining cooperation from Russian authorities is virtually impossible.

Now, investigators may have made a major breakthrough. Cybersecurity experts claim to have identified the administrator of Qilin. According to their findings, he may be 36-year-old Alexey Mikhailovich Yakovtsev, a resident of St. Petersburg.

Yakovtsev, who holds a master’s degree in computer engineering and information systems, is believed to have progressed from credit card fraud to managing sophisticated botnets and ransomware operations.

According to cybersecurity companies Intel 471, Flashpoint, and IntelHawk, Yakovtsev appears to have made several critical mistakes that allowed researchers to identify him.

The Qilin administrator currently uses the alias Haise. He previously operated under different names, as cybercriminals frequently change their usernames for security reasons. However, when registering on new private forums, they sometimes have to reference their previous accounts. If these forums are hacked or seized by law enforcement, the information can be used to link different accounts together. That is exactly what happened with Haise. In June 2022, a user operating under this alias applied to join RAMP, a private Russian cybercrime forum that was seized by the FBI in January 2026.

Qilin Administrator Does Not Leave Russia

An Intel 471 employee indexed private messages from the RAMP forum. Among them was a conversation in which the forum administrator approved Haise’s application, referring to him not only by that alias but also by his Telegram username, Alexbigboss44. After examining Intel 471’s database, KrebsOnSecurity discovered that the same Telegram username had been used by an individual operating under the alias Rjun on the Russian cybercrime forums Exploit and XSS.

According to Flashpoint, Alexbigboss44 was highly active on these platforms. He allegedly collected large volumes of stolen Facebook data and Google Ads accounts, which were used for fraudulent advertising campaigns and gambling-related schemes.

Analysts at IntelHawk, a cybersecurity platform specializing in identifying anonymous threat actors, traced the evolution of his activities. In 2018–2019, he was allegedly involved in traffic arbitrage and credit card fraud. By 2020–2023, he had become an experienced participant and organizer of sophisticated cybercriminal operations, increasingly focusing on malware, botnets, and payment infrastructure.

By the time Alexbigboss44 applied to join RAMP, Rjun already had accounts on other Russian forums. He had registered on all these platforms using the same email address: [email protected]. A search for this address through Constella Intelligence, a data breach monitoring service, revealed that it appeared in records associated with gosuslugi.ru, Russia’s official government and municipal services portal.

A data breach involving Gosuslugi occurred in late 2025. According to reports, more than 20 million records containing users’ full names, dates of birth, and mobile phone numbers were exposed. Based on the leaked data, the email address [email protected] belongs to 36-year-old Alexey Yakovtsev from St. Petersburg. In addition, records from Russia’s federal education supervisory authority, Rosobrnadzor, indicate that Yakovtsev attended school in Murmansk and holds a master’s degree in computer engineering and information systems.

It is worth noting that no law enforcement agency has officially confirmed these findings. Even if the discovered digital traces ultimately help establish the Qilin administrator’s identity, arresting him would remain a difficult task. According to available information, Yakovtsev has never traveled outside Russia by air, and securing his arrest within the country would be virtually impossible.