Per Krebs on Security, the cybercrime group Qilin has become the most active ransomware-as-a-service operation, with researchers identifying the group's administrator as a 36-year-old man residing in St. Petersburg, Russia.
Qilin has targeted at least 365 organizations over the past three months, utilizing a double extortion model where sensitive data is stolen before systems are encrypted. The group distinguishes itself by collaborating with English-speaking affiliates and partnering with other prominent ransomware gangs. Despite the administrator operating under the handle Haise, cybersecurity firms including Intel 471, Flashpoint and IntelHawk have traced the identity back to a user previously known as Rjun and Alexbigboss44. By analyzing historical forum memberships, leaked data from the Russian government portal Gosuslugi and travel records, researchers linked these digital monikers to Aleksey Mikhailovich Yakovtsev. The investigation utilized stylometry, shared email addresses and phone numbers to connect the suspect to the criminal infrastructure. Yakovtsev, who holds a master’s degree in computing and information systems, allegedly progressed from credit card fraud to managing complex botnets and ransomware operations. While the findings provide a detailed profile of the individual behind Qilin, attempts to contact the suspect were unsuccessful. This case highlights how even sophisticated cybercriminals can be de-anonymized through operational security lapses and the aggregation of data from historical breaches.
Source: Krebs on Security
