Researchers link Qilin ransomware administrator to St. Petersburg man - SC Media
Cybersecurity researchers have identified the administrator of Qilin ransomware as a 36-year-old man from St. Petersburg, Russia, according to Krebs on Security.
Qilin has emerged as the most active ransomware-as-a-service operation, having targeted at least 365 organizations over the past three months. The group employs a double extortion model, stealing sensitive data before encrypting systems, and distinguishes itself by collaborating with English-speaking affiliates and partnering with other prominent ransomware gangs.
Identity traced through aliases
Despite the administrator operating under the handle Haise, cybersecurity firms including Intel 471, Flashpoint and IntelHawk traced the identity back to a user previously known as Rjun and Alexbigboss44. Researchers connected these digital monikers to Aleksey Mikhailovich Yakovtsev by analyzing historical forum memberships, leaked data from the Russian government portal Gosuslugi and travel records.
The investigation utilized stylometry, shared email addresses and phone numbers to connect the suspect to the criminal infrastructure.
Background and investigation
Yakovtsev, who holds a master's degree in computing and information systems, allegedly progressed from credit card fraud to managing complex botnets and ransomware operations. While the findings provide a detailed profile of the individual behind Qilin, attempts to contact the suspect were unsuccessful.
This case highlights how even sophisticated cybercriminals can be de-anonymized through operational security lapses and the aggregation of data from historical breaches.
Related
