Russia-based ransomware group Qilin has emerged as the world’s most active affiliate program, claiming at least 365 victim organizations in just three months. But behind this seemingly sophisticated operation lies a trail of operational security mistakes made by its administrator, Haise. A decade-long digital footprint reveals that Haise is likely a 36-year-old man living in St. Petersburg, Russia.
Qilin’s success can be attributed to its adoption of the “double extortion” model, which involves stealing sensitive data before encrypting systems and threatening to publish it online. The group offers affiliates at least 80 percent of any extortion amount paid by victims, making it an attractive option for cybercriminals. Unlike many Russian-based ransomware partnerships, Qilin is willing to collaborate with English-speaking affiliates, and its leader has even worked with other groups like Scattered Spider and RansomHub.
Haise’s use of multiple handles over the years has provided a crucial clue to his true identity. As an operational security measure, cybercriminals often change their handles periodically to sever ties to older identities that may have been careless about separating real-life activities from cybercrime operations. However, when applying for membership at new forums, they sometimes reference their past monikers. This is precisely what happened with Haise.
In June 2022, Haise applied for membership on RAMP, a closely guarded Russian cybercrime forum created as a haven for ransomware affiliate programs. Intel 471 records show that the RAMP administrator approved Haise’s application, referring to him as Haise and by his Telegram username, Alexbigboss44. Further investigation revealed that Alexbigboss44 is linked to another user, Rjun, who was active on several Russian cybercrime forums in 2020.
Rjun, aka Alexbigboss44, was involved in high-volume acquisition of Facebook logs and Google Ads accounts for fraudulent advertising and gambling schemes. This individual functioned as a broker and operator, managing a network of traffickers and purchasing compromised data to fuel their operations. The connection between Haise and Rjun/Alexbigboss44 identities shows a progression from novice cybercrime activities in 2018-2019 to more complex involvement in malware, botnets, and payment infrastructure by 2020-2023.
The trail of evidence leads back to 2018-2019, when Rjun was signing up for various Russian crime forums with the email address mail-30a@mail.ru. Spycloud found that this email address is linked to other cybercrime activities, further solidifying the connection between Haise’s different identities.
This story serves as a reminder that even top cybercriminals can make operational security mistakes. As Qilin continues to wreak havoc on organizations worldwide, it’s essential for companies and individuals to be vigilant about protecting themselves against ransomware attacks. This includes keeping software up-to-date, using strong passwords, and regularly backing up data. By being proactive and informed, we can reduce the impact of these types of attacks and keep our digital lives secure.
Source: Krebs on Security — 2026-11-11