Cyber — 2026-11-12
Krebs Investigation Identifies Russian Aleksey Yakovtsev as Administrator of World's Most Active Ransomware Group Qilin
BLUFGovernment or law-enforcement authorities are very unlikely to publicly sanction, charge, or confirm Aleksey Yakovtsev as Qilin's administrator by December 12, because the identification rests on leaked records no agency has endorsed and Yakovtsev remains beyond extradition in Russia.
KrebsOnSecurity reported on November 11 that Qilin, active since September 2022, claimed at least 365 victims in three months, and that NCC Group ranks it the most active ransomware affiliate program 1. Krebs traced Qilin's administrator "Haise" through the older aliases Rjun and Alexbigboss44, forum records, and Telegram identifiers to Aleksey Mikhailovich Yakovtsev, 36, of St. Petersburg, using leaked Gosuslugi records and an IntelHawk analysis 1. Yakovtsev did not respond to Krebs's email and phone inquiries 1. SOCRadar reported that the anonymous account GangExposed reached a similar identification, that no authority has confirmed it, and that nothing publicly links Haise to the Russian arrested in Germany in October 2. Mallory described the finding as an investigative attribution, not an official determination 3.
AnalysisConfidence is moderate, resting on a single original investigation, a parallel anonymous-leaker claim built on the same tooling, and no agency statement. The identification draws on leaked Russian government, telecom and forum records that outsiders cannot authenticate, so prosecutors would need their own evidence before naming him. A government or law-enforcement authority, such as the US DOJ, Treasury/OFAC, Europol, or German authorities, is
very unlikely to publicly sanction, charge or confirm Aleksey Yakovtsev as Qilin's administrator between November 13 and December 12, 2026. Yakovtsev appears to reside in Russia and has flown only domestically, which keeps arrest or extradition out of reach. Western agencies may already hold a similar identification and be withholding it to protect an ongoing case, so public silence would not show the name is wrong or unwanted. If an agency confirms the name, sanctions and indictment would let financial institutions and incident-response teams treat him as a designated target. Until then the claim stays an unverified lead, and defenders should not act on it beyond routine Qilin hardening. Better signals are whether Qilin affiliates leave the program and whether the German suspect in custody is tied to Haise.
3 sources
- Who Runs the Ransomware Group Qilin? - Krebs on Security
- Qilin Ransomware Admin Haise Allegedly Unmasked - SOCRadar
- Investigation Links Qilin Ransomware Administrator to St. Petersburg Resident - Mallory