Aleksey Mikhailovich Yakovtsev lives in St. Petersburg. He holds a master’s degree in computing and information systems. He’s dabbled in credit card fraud before. But he also runs Qilin, the most prolific cybercrime group in the world.

Qilin, the Russia-based ransomware group, is considered the most industrious ransomware-as-a-service gang in the world. It has claimed at least 365 victim organizations in the past three months alone.

Typically, Qilin and its affiliates – who are usually offered roughly 80% of any ransom paid by victims – use a double extortion model where sensitive data is stolen before systems are encrypted.

Key missteps led to a breakthrough

Because cyberattacks cost companies and organizations vast sums of money, investigators worldwide are desperately hunting Qilin operatives. However, their efforts haven’t been very successful so far.

Granted, just last October, Japanese police arrested one alleged Qilin member and extradited him to Germany. But most group members are based in Russia, and since Moscow makes good use of hackers, getting Russian authorities to cooperate is nearly impossible.

Now, though, a major breakthrough might have occurred. Cybersecurity experts claim to have unmasked Qilin’s administrator as 36-year-old Aleksey Mikhailovich Yakovtsev, residing in St. Petersburg, Russia.

Yakovtsev, who holds a master’s degree in computing and information systems, allegedly progressed from credit card fraud to managing complex botnets and ransomware operations.

According to cybersecurity firms including Intel 471, Flashpoint, and IntelHawk, it appears Yakovtsev made a few key missteps that allowed online sleuths to trace his identity.

Currently, the Qilin administrator goes by the handle “Haise.” He used other aliases previously, as cybercrooks frequently change handles for security reasons.

However, criminals sometimes still have to reference past monikers when applying for membership on another forum. When those forums are hacked or seized, connecting the dots becomes possible.

That’s exactly what happened with “Haise.” In June 2022, Yakovtsev applied for membership to RAMP, a secretive Russian cybercrime forum, seized by the FBI in January 2026.

Doesn’t fly out of Russia

Intel 471 has indexed direct messages from RAMP, and they show the RAMP administrator approving “Haise’s” application and referring to the user as “Haise” and also calling him by his Telegram username – “Alexbigboss44.”

After searching Intel 471’s database, KrebsOnSecurity found that this Telegram username was shared by a user named “Rjun” on Russian cybercrime forums Exploit and XSS.

“Alexbigboss44” was very active on message boards, according to cybersecurity firm Flashpoint. The user allegedly engaged in high-volume acquisition of Facebook logs and Google Ads accounts to facilitate fraudulent advertising and gambling schemes.

According to IntelHawk, a cybersecurity platform specializing in threat-actor deanonymization, an analysis of these identities reveals a progression from novice arbitrageur and credit card fraudster in 2018–2019 to an experienced participant and organizer of complex cybercrime activities in 2020–2023, with increasing focus on malware, botnets, and payment infrastructure.

By the time “Alexbigboss44” applied for membership on RAMP, “Rjun” was already a member of other Russian forums, registering across all of them using the email address [email protected].

A search for that email address on the breach-tracking service Constella Intelligence showed that it appeared in records maintained by gosuslugi.ru, the official digital platform for state and municipal services in the Russian Federation.

Then, a search for that email at the breach tracking service Constella Intelligence showed that it appeared in records maintained by gosuslugi.ru, the official digital platform for state and municipal services in the Russian Federation.

Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers.

And according to the leaked Gosuslugi records, the address [email protected] belongs to 36-year-old Yakovtsev from St. Petersburg.

Additionally, records from Russia’s education watchdog Rosobrnadzor reveal that Yakovtsev went to grade school in Murmansk and that he holds a master’s degree in computing and information systems.

It is worth noting that no law enforcement agency has confirmed these findings so far. Even if the leads prove actionable, Yakovtsev has never traveled by plane outside Russia—and apprehending him in his homeland is nearly impossible.