GoKawiilResearch ties Qilin ransomware leader 'Haise' to St. Petersburg man
Security researchers have linked the administrator of the Qilin ransomware-as-a-service operation, who uses the handle 'Haise,' to a 36-year-old man in St. Petersburg, Russia. The identification draws on operational security mistakes made over roughly a decade, including reused handles traced through leaked forum registration data analyzed by the platform Intel 471. Qilin has claimed at least 365 victim organizations over the past three months, making it the most active ransomware affiliate program currently tracked.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings illustrate how even sophisticated cybercriminal operators can be unmasked through small, repeated opsec errors like handle reuse across forums that are later breached or seized. Because Qilin recruits English-speaking affiliates and collaborates with groups like Scattered Spider and RansomHub, pinning down its leadership could help investigators map a wider criminal network rather than a single actor. However, identification alone does not guarantee legal consequences, since the suspect is believed to be operating from Russia, which rarely extradites cybercrime suspects.
- Qilin is currently the world's most active ransomware-as-a-service group, with 365+ victims in three months.
- Researchers tie Qilin's leader 'Haise' to a 36-year-old man in St. Petersburg via old forum registration data.
- Qilin uniquely partners with English-speaking affiliates and groups like Scattered Spider and RansomHub.
YubiKey 5 NFC Security Key — Ransomware gangs like Qilin typically gain entry through stolen credentials and phishing, so hardware-based multi-factor authentication is one of the best defenses for individuals and small businesses. A YubiKey lets you secure logins with physical two-factor authentication that's much harder for attackers to bypass than SMS codes or app-based prompts.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: krebsonsecurity.com, 2026-11-11
Published there as: “Who Runs the Ransomware Group Qilin?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.