The anonymous administrator known as “Haise,” who manages the prolific Qilin ransomware-as-a-service gang, has been identified by researchers as 36-year-old Aleksey Mikhailovich Yakovtsev. Based in St. Petersburg, Russia, Yakovtsev’s operational security failures—including linked historical aliases and leaked state database records—have effectively unmasked the leader of the world’s most active ransomware operation.
A Decade of Digital Footprints
Cyber intelligence platform Intel 471 documented that the administrator known as Haise applied for membership to the RAMP cybercrime forum in June 2022. While criminals often rotate handles to sever ties with past identities, Haise’s application inadvertently linked the Qilin leadership to a long-standing cybercriminal identity: “Rjun.”
The RAMP administrator, operating before the forum’s seizure by the FBI in January 2026, explicitly confirmed the link between Haise and the Telegram handle Alexbigboss44. This handle was previously utilized by the user Rjun on forums such as Exploit and XSS as early as 2020.
From Amateur Fraud to Ransomware
Before orchestrating the Qilin affiliate program, which has claimed at least 365 victim organizations in the past three months, the individual behind these handles focused on lower-level cybercrime. According to findings from Flashpoint, the user Rjun engaged in high-volume acquisition of Facebook logs and Google Ads accounts.
These activities facilitated fraudulent advertising and gambling schemes. Leo Bogod, founder and CTO of the AI-based de-anonymization platform IntelHawk, described a clear progression in the actor’s technical capabilities.
An analysis of these identities shows a progression from novice arbitrageur and credit card fraudster in 2018–2019 to a more experienced participant and organizer of complex cybercrime-related activities in 2020–2023, with increasing attention to malware, botnets, and payment infrastructure. Leo Bogod
The Breach that Exposed the Admin
The collapse of Yakovtsev’s anonymity began with an email address: [email protected]. This address was associated with the Rjun account across multiple Russian crime forums, including Darkmarket and Verified.
Records from the gosuslugi.ru digital platform, which suffered a massive data breach in late 2025, confirmed the identity behind the email. The breach exposed over 20 million records, including the name Aleksey Mikhailovich Yakovtsev. Further verification came through Spycloud, which identified the password “Rjun132” as being used with the same email address.
Pivoting Through Travel and Family Records
Aleksey Yakovtsev’s digital trail extends beyond forums into physical reality. Telegram user ID 118329521, used by Haise for over 5,000 messages, is linked to the Russian phone number +79602347275.
Constella Intelligence records confirm this number is associated with Yakovtsev’s biological sister, whose email address he frequently used for account registrations. Airline flight records, also compromised in recent data breaches, show Yakovtsev—born August 18, 1990—frequently traveling between St. Petersburg and the resort city of Sochi.
Operational Security Realities
Qilin operates on a “double extortion” model, where affiliates steal sensitive data before encrypting systems and threatening to publish the files. Unlike many Russian-based groups, Qilin maintains an open-door policy for English-speaking affiliates, boasting of partnerships with groups like RansomHub.
Despite these sophisticated operational tactics, the administrator’s reliance on legacy email accounts and consistent use of family-linked identifiers provided the necessary signals for de-anonymization. Attempts to reach Yakovtsev for comment have yielded no response. The identification of the Qilin administrator follows the June profiling of the administrator of the second most active ransomware group — The Gentlemen — by KrebsOnSecurity.
