Qilin ransomware administrator “Haise” has been linked through historical cybercrime accounts to a 36-year-old individual in St Petersburg, Russia. The identification remains an open-source assessment and has not been confirmed by law enforcement.
The disclosure comes as Qilin ransomware leads recent activity rankings. NCC Group recorded 365 claimed attacks linked to the operation in Q3 2026, making it the most active ransomware affiliate programme during that period.
How the Qilin ransomware identity claim emerged
The alleged identification first became public on 6 November 2026, when SOCRadar reported that the Telegram channel GangExposed had published an investigation into Haise. SOCRadar explicitly described the claim as unverified.
On 11 November 2026, KrebsOnSecurity published a separate, detailed profile connecting the Haise persona to a specific individual in St Petersburg. The investigation correlated accounts used across underground forums with a Telegram identifier that appeared under multiple identities over several years.
The trail from Haise to earlier accounts
A profile for Haise appeared on RAMP on 29 May 2022. RAMP was a Russian-language cybercrime forum used by ransomware operators to advertise affiliate programmes, recruit intrusion specialists and build reputations within the criminal ecosystem.
Intel 471 records cited in the investigation show that Haise applied for RAMP membership in June 2022. Messages associated with the application reportedly connected the Haise account to the Telegram username “Alexbigboss44”.
The same Telegram identifier had previously been shared in 2020 by a user called “Rjun” on the Exploit and XSS cybercrime forums. Historical activity connected with Alexbigboss44 reportedly involved the illicit trade in website traffic, stolen logs and access to corporate networks.
This reuse of a Telegram identifier is central to the attribution. Criminal operators regularly change aliases to separate current activities from older accounts, but references made during forum applications can reconnect those identities. Archived messages can remain accessible after forums are breached, leaked or seized.
The FBI seized RAMP on 28 January 2026. Records from the forum are particularly relevant because Haise later advertised the Qilin ransomware affiliate programme there in February 2023.
However, the account correlations do not constitute official proof that the named individual controlled Haise or Qilin. No law enforcement agency had confirmed the real-world identity by 11 November 2026, so the claim should be treated as a substantial investigative lead rather than a settled attribution.
Qilin ransomware activity and affiliate model
Qilin developed from the Agenda ransomware family, which researchers first observed in July to August 2022. The operation was publicly rebranded as Qilin around September 2022 and subsequently expanded into a ransomware-as-a-service business.
Under this model, the core operators maintain the malware, leak infrastructure and negotiation systems. Affiliates obtain access to victim organisations, steal information and deploy the encryptor. Reported payment arrangements give affiliates 80 to 85 per cent of each extortion payment, while the operators retain 15 to 20 per cent.
This generous split helps Qilin attract experienced intrusion crews. Unlike some Russia-based programmes, it has also worked with English-speaking affiliates. Microsoft observed Scattered Spider adding Qilin and RansomHub payloads to its toolkit in 2024, illustrating how the malware can be deployed by groups outside Qilin’s central team.
NCC Group ranked Qilin as the most active ransomware group in Q3 2026, attributing 365 claimed attacks to it. The next most active operation, The Gentlemen, was associated with 359. These totals are based on observed or claimed activity and do not necessarily represent every successful intrusion.
Double extortion and affected environments
Qilin ransomware uses double extortion. Affiliates steal sensitive files before encryption, then threaten to publish them through a Tor leak site if the victim refuses to pay. Some incidents have also involved a clearnet IP address that allows victims to access communications without Tor.
The operation has Windows and Linux payloads, including functionality designed for VMware ESXi infrastructure. Versions written in Go and Rust have been documented, allowing affiliates to target enterprise domains, network shares, servers and virtual machines.
Healthcare, manufacturing and other industries have appeared prominently among reported victims. In the UK, Qilin attacked pathology provider Synnovis on 3 June 2024, disrupting NHS services in London. The group published stolen Synnovis data on its leak site and Telegram channel on 20 June 2024.
How Qilin ransomware attacks work
There is no single vulnerability or affected software version behind Qilin’s campaigns. Affiliates choose their own access methods, which can include phishing, exposed remote access services, remote monitoring and management tools, and Cobalt Strike infrastructure.
After obtaining access, attackers can move through Windows environments using PsExec and deploy separate encryptors across different systems. WinSCP and Cyberduck have been observed transferring stolen information before encryption begins.
Documented Qilin ransomware behaviours include:
- Terminating processes and services that could prevent encryption.
- Deleting shadow copies to obstruct straightforward recovery.
- Using vulnerable kernel drivers to disable security controls.
- Encrypting Windows, Linux and VMware ESXi systems.
- Applying hybrid encryption schemes involving ChaCha20 and RSA-4096.
- Changing extensions and ransom note names according to affiliate configuration.
Observed host artefacts include RunOnce registry persistence pointing to a copy under the Windows Public directory. File extensions may be randomised, with “.MmXReVIxLV” documented as one example, while ransom notes can follow patterns such as “README-RECOVER-<id>.txt”.
One reported sample has the SHA256 hash 5acd1ff8da9958a032cf63fb27d5e4b71c201612461e039f44eb07b2cc6735c0. This is contextual evidence rather than a universal signature, because Qilin builds and configurations vary between campaigns. No authoritative current IP addresses or domains were published in the reviewed reporting.
Qilin remains active in the wild, and no public decryptor is currently reported. The exposure of Haise’s possible identity has not been shown to have disrupted the programme, its infrastructure or its affiliate network.
What organisations should do about Qilin
Organisations should focus on the access and movement methods associated with this specific operation. Multi-factor authentication should cover remote access, administrative accounts and remote management platforms, while exposed services should be patched promptly.
Security teams should monitor for unexpected PsExec execution, new RunOnce entries, shadow copy deletion, vulnerable driver loading and unusual use of WinSCP or Cyberduck. Large outbound transfers followed by service termination or activity across virtual infrastructure should receive immediate investigation.
Because Qilin ransomware combines data theft with encryption, tested offline backups alone are not sufficient. Organisations also need controls that can identify mass file access and exfiltration before the encryptor is deployed.
Originally reported by krebsonsecurity.com.
