Scworld Qilin Ransomware Group Linked to St. Petersburg Administrator
Article Content
- •Qilin ransomware group has targeted over 365 organizations in three months.
- •The group's administrator is linked to a St. Petersburg man named Aleksey Mikhailovich Yakovtsev.
- •Qilin utilizes a double extortion model, collaborating with English-speaking affiliates.
The Qilin ransomware group has been identified as the most active ransomware-as-a-service operation, targeting at least 365 organizations in the past three months. The group's administrator, a 36-year-old man from St. Petersburg, Russia, operates under the handle 'Haise' and has been linked to previous aliases, including 'Rjun' and 'Alexbigboss44'. Qilin employs a double extortion model, stealing sensitive data before encrypting systems. The investigation utilized data from cybercrime forums, leaked government data, and travel records to trace the administrator's identity to Aleksey Mikhailovich Yakovtsev. Despite the detailed profile, attempts to contact Yakovtsev were unsuccessful. This case illustrates how operational security lapses can lead to the de-anonymization of cybercriminals.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Qilin and Scattered Spider in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Who is the administrator of Qilin?
What is the attack method used by Qilin?
How many organizations have been targeted?
Continue Reading
Ransomware Attack Exposes Burnaby School District Data on Dark Web The Burnaby School District in British Columbia experienced a ransomware attack on September 21, 2026, allegedly perpetrated by the Russian hacker group Qilin. The group claims to have posted sensitive data, including personal information of students and staff, on the dark web. The school district confirmed that the… 
Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin…