"‼️ BREAKING: Security journalist Brian Krebs says the man running Qilin, the world's most ...

X • November 12, 2026

International Cyber Digest @IntCyberDigest ‼️ BREAKING: Security journalist Brian Krebs says the man running Qilin, the world's most active ransomware gang, is 36-year-old Aleksey Yakovtsev of St. Petersburg. Researchers traced the boss's handle "Haise" through old forum names to a mail[.]ru address whose password was built from one of them. That address sits in leaked records from Russia's own hacked government services portal. Qilin has claimed 365+ victims in three months. 5:04 AM · Nov 12, 2026 · 24.1K Views 13

International Cyber Digest @IntCyberDigest 4h Source: krebsonsecurity.com/2026/11/who-ru… Don't miss out on any news, join our : internationalcyberdigest.com/ / Be sure to join our TG channel: t.me/IntCyberDigest

International Cyber Digest @IntCyberDigest 30m Credits to @GangExposed_RU , who was first to find the suspect and whose research has been crucial in uncovering Russian ransomware operators: GangExposed RU @GangExposed_RU Nov 5 Who Runs Qilin? Identifying Haise A new investigation identifies Haise, a Qilin administrator, as Alexey Yakovtsev. The findings were developed entirely on the @InteIHawk platform using its internal sources. Full investigation: justpaste.it/iosba

The Cyber Post @TheCyberPost1 3h I beleive @GangExposed_RU did find this recently before krebs too 3

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin Ransomware Group Linked to St. Petersburg Administrator The Qilin ransomware group has been identified as the most active ransomware-as-a-service operation, targeting at least 365 organizations in the past three months. The group's administrator, a 36-year-old man from St. Petersburg, Russia, operates under the handle 'Haise' and has been linked to previous aliases, including 'Rjun' and 'Alexbigboss44'. Qilin employs a double extortion model, stealing sensitive data before encrypting systems. The investigation utilized data from cybercrime forums, leaked government data, and travel records to trace the administrator's identity to Aleksey Mikhailovich Yakovtsev. Despite the detailed profile, attempts to contact Yakovtsev were unsuccessful. This case illustrates how operational security lapses can lead to the de-anonymization of cybercriminals. 3 sources 51

Extracted Entities

"‼️ BREAKING: Security journalist Brian Krebs says the man running Qilin, the world's most ...

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Domains (2)

Ransomware Groups (1)