The Mask Slips. The Ransomware Boss Has a Name.

For years, the person running the world’s busiest ransomware group was just a username. Now, researchers say, he has a name.

Cybersecurity researchers allege that the administrator of Qilin — the ransomware operation that has claimed at least 365 victim organizations in the past three months — is Aleksey Mikhailovich Yakovtsev, a 36-year-old man living in St. Petersburg, Russia. Pieced together by Intel 471, Flashpoint and IntelHawk and first reported in detail by KrebsOnSecurity, the identification was built not from a single leak but from a decade of small mistakes: old forum handles, a reused Telegram username, and an email address that turned up in a breached government database.

The busiest gang in the world

Qilin has been operating since September 2022, and by the measure that matters most to victims — the number of organizations named on its leak site — it is currently the most industrious ransomware gang on the planet, according to the cybersecurity firm NCC Group’s November report.

The model is familiar, and it is why the group is so prolific. Qilin does not hack most of its victims directly. Instead it recruits affiliates — other criminals who break into companies and deploy the ransomware — and offers them at least 80 percent of whatever ransom gets paid. Victims face the standard double extortion: sensitive data is stolen before systems are encrypted, then the gang threatens to publish the files unless the ransom is paid. Unlike most Russian-based ransomware partnerships, Qilin is happy to work with English-speaking affiliates.

One handle led to the next

The trail starts with the handle the Qilin administrator uses today: “Haise.” In June 2022, Haise applied to join RAMP, a closely guarded Russian-language cybercrime forum for ransomware affiliate programs. Intel 471, which has indexed direct messages from RAMP — the forum was seized by the FBI in January 2026 — found the messages in which the RAMP administrator approved Haise’s application, referring to the applicant both as “Haise” and by a Telegram username: “Alexbigboss44.”

That second name was the thread that unraveled everything. Searching Intel 471’s database, KrebsOnSecurity found that “Alexbigboss44” was the Telegram account shared by a user called “Rjun” on the Russian cybercrime forums Exploit and XSS in 2020. Flashpoint’s records show that user was a prolific participant in criminal forums, trading in stolen traffic, logs and corporate access, and buying Facebook logs and Google Ads accounts at high volume for fraudulent advertising and gambling schemes.

IntelHawk, which specializes in de-anonymizing threat actors from old usernames and writing style, says the identities show a clear progression: a novice arbitrageur and credit-card fraudster in 2018–2019, becoming an organizer of complex cybercrime by 2020–2023, increasingly focused on malware, botnets and payment infrastructure.

Diagram: the username chain from Haise to Yakovtsev — The alias chain that researchers say leads from the Qilin administrator “Haise” to a real name.

The final link came from a breach. The forum identity was registered with an email address that appears in records from gosuslugi.ru, Russia’s official digital services platform, breached in late 2025 with more than 20 million records reportedly exposed. According to those records, surfaced by the breach-tracking service Constella Intelligence, that address belongs to Yakovtsev. Russia’s education watchdog, Rosobrnadzor, adds two fitting details: he went to grade school in Murmansk, and he holds a master’s degree in computing and information systems. The anonymous account GangExposed, which has a record of identifying suspected ransomware actors, reached similar conclusions. KrebsOnSecurity says its attempts to reach Yakovtsev were unsuccessful.

The big caveat

None of this has been confirmed by police, and the evidence is circumstantial — a chain of linked usernames and leaked records, not a confession or an arrest. Even if the identification is correct, an arrest looks a long way off: Yakovtsev has never traveled by plane outside Russia, according to flight records cited in the research, and Moscow makes little use of its hackers except to protect them. There has been one crack in the wall — just last October, Japanese police arrested one alleged Qilin member and extradited him to Germany — but the administrator, if the researchers are right, remains at home in St. Petersburg.

What it means for defenders

A name is not a shutdown. Qilin’s affiliate program is still running, its leak site is still naming victims, and the affiliates who do the actual break-ins are unaffected. For organizations, the defenses do not change: offline backups that ransomware cannot reach, fast patching of internet-facing systems, and network segmentation so one compromised machine does not become a compromised company.

Diagram: what the unmasking means and what defenders should do — A name is not an arrest — and the gang is still operating.

But the unmasking still matters. Ransomware groups survive on the belief that their operators are untouchable, and every identification chips away at that. It is also a lesson in operational security. Haise’s mistake was not one dramatic slip — it was a decade of small ones: reusing a handle, referencing an old nickname on a forum application, registering accounts with an email address tied to a real identity. Forums get hacked or seized. Old handles do not die. They get linked.

The same lesson applies far beyond cybercrime: the usernames and email addresses you used ten years ago are still out there, still searchable, still connected to you. The difference between Yakovtsev and the rest of us is only what those old accounts were used for.

Breaking News