Unmasking “Haise”: How a Decade of Digital Footprints Led Investigators to the Mastermind Behind Qilin Ransomware

Executive Overview

In

the high-stakes, shadowy underworld of cybercrime, operational security (opsec) is the ultimate currency. Even the most prolific threat actors routinely cycle through aliases, digital personas, and encrypted messaging channels to protect their real-world identities from law enforcement agencies and investigative journalists. Yet, beneath layers of anonymized infrastructure and carefully cultivated underground reputations, human error remains the ultimate equalizer.

Recent intelligence reports position the Qilin ransomware syndicate as the most industrious and active ransomware-as-a-service (RaaS) affiliate program on the global stage. Having claimed at least 365 victim organizations in a mere three-month window, Qilin operates at an unprecedented industrial scale. However, a meticulous digital paper trail—forged through years of forum registrations, breached databases, shared messaging handles, and familial data spillages—has finally punctured the cloak of anonymity surrounding the operation’s supreme leader.

According to an exhaustive cross-platform investigation utilizing threat intelligence from firms like NCC Group, Intel 471, Flashpoint, and the AI-driven de-anonymization engine IntelHawk, the man pulling the strings behind Qilin is Aleksey Mikhailovich Yakovtsev, a 36-year-old native of Murmansk, Russia, currently operating out of St. Petersburg.

This comprehensive exposé chronicles how a decade-long evolution from low-level credit card fraud and ad traffic arbitrage to sophisticated cyber extortion ultimately collapsed under the weight of interconnected historical accounts and massive state-level data breaches.

Detailed Chronology: From Petty Arbitrage to Global Extortion

The de-anonymization of Qilin’s administrator—who operates under the prominent handle "Haise"—underscores a fundamental vulnerability inherent in the modern cybercriminal lifecycle: the unavoidable necessity of leveraging historical reputation to secure standing within elite underground forums.

The Genesis: Rjun and Alexbigboss44 (2018–2020)

Long before Haise became a household name among cybersecurity incident responders, the individual behind the moniker was cutting their teeth on Russian-language dark web forums under older handles. Cyber intelligence platforms including Intel 471 and Flashpoint have mapped out a clear behavioral and infrastructural evolution.

Between 2018 and 2019, the user operated primarily as a novice arbitrageur, dabbling in credit card fraud, malicious ad traffic, and purchasing compromised logs. By 2020, this persona had solidified into the handle "Rjun" on prominent Russian cybercrime forums such as Exploit, XSS, Darkmarket, Verified, and Zloy.

During this foundational phase, Rjun consistently registered accounts using a specific email address: [email protected]. Concurrently, the user established a foothold on Telegram, utilizing the handle Alexbigboss44 (associated with Telegram User ID 118329521). Under this identity, the actor managed a sprawling network of traffickers, focusing heavily on the illicit acquisition of Facebook logs and Google Ads accounts to fuel large-scale fraudulent advertising and illegal gambling schemes.

The Rise of Haise and the RAMP Connection (2022)

Operating a successful enterprise in the underground economy often requires rebranding to shed the baggage of past scams or heightened law enforcement scrutiny. As the geopolitical and cybercriminal landscapes shifted following the onset of the Russia-Ukraine war, specialized forums emerged to cater specifically to ransomware syndicates.

In June 2022, the user applied for membership in RAMP—a closely guarded, highly vetted Russian cybercrime forum designed expressly as a haven for ransomware affiliate programs. According to archived direct messages indexed by Intel 471 prior to the forum’s seizure by the FBI in January 2026, the RAMP administrator approved the application of the user known as Haise. Crucially, the administrative logs explicitly tied Haise to the long-standing Telegram handle: Alexbigboss44.

This bridge between past and present identities proved fatal to the administrator’s operational security. By linking the contemporary ransomware kingpin Haise back to the historical forum user Rjun and the Telegram handle Alexbigboss44, intelligence analysts established a continuous, unbroken chain of custody over the actor’s digital infrastructure.

The Qilin Empire and the 2025–2026 Climax

Founded around September 2022, Qilin rapidly ascended to the pinnacle of the RaaS ecosystem. The group differentiates itself through a lucrative affiliate model, offering perpetrators up to 80 percent of any extortion payout extracted from victims. Employing a ruthless "double extortion" methodology, Qilin operatives systematically exfiltrate sensitive corporate data prior to encrypting local networks, threatening public data leaks if ransom demands are ignored.

Unlike insular Russian cybercrime syndicates that strictly vet participants based on nationality, Qilin aggressively courts English-speaking affiliates. Haise himself acknowledged via Telegram channels that the group has successfully partnered with notorious threat groups such as Scattered Spider and RansomHub.

Yet, even as Qilin claimed hundreds of enterprise victims globally, the administrator’s digital footprint expanded outward, intersecting with catastrophic data leaks within the Russian Federation that would ultimately seal his fate.

Supporting Context & Metrics: The Anatomy of a RaaS Giant

Understanding the scale of Qilin’s operations provides crucial context as to why international threat intelligence firms have prioritized unmasking its leadership.

Threat Intelligence & Industry Metrics

• Victim Volume: According to a September 2026 quarterly threat intelligence report published by NCC Group, Qilin firmly cemented its status as the world’s most industrious ransomware affiliate program, registering at least 365 victim organizations within a narrow three-month window.
• Affiliate Incentive Structure: By offering an unprecedented 80%+ payout split to affiliates, Qilin incentivized rapid deployment and high-volume targeting across diverse industry verticals, including healthcare, manufacturing, and critical infrastructure.
• Ecosystem Synergy: The group’s operational flexibility allowed it to act as a clearinghouse for disparate cybercriminal skill sets, bridging the gap between elite Russian malware developers and Western-centric social engineering crews like Scattered Spider.

The De-Anonymization Vector: How the Pieces Fell Into Place

The collapse of Haise’s anonymity was not the result of a single slip-up, but rather a masterclass in correlative intelligence gathering executed by platforms like IntelHawk, Spycloud, and Constella Intelligence.

1. The Email Anchor: Rjun’s forum registration email ([email protected]) was tied to the password Rjun132 in historical credential stuffing databases cataloged by Spycloud.
2. State Database Leaks: The exact email address appeared within records originating from gosuslugi.ru, the official digital portal for state and municipal services in the Russian Federation, which suffered a massive data breach in late 2025 exposing over 20 million citizen records.
3. Identity Confirmation: The leaked Gosuslugi records definitively linked [email protected] to Aleksey Mikhailovich Yakovtsev, born August 18, 1990.
4. Corroborating Telephony & Family Ties: The Telegram ID (118329521) tied to Alexbigboss44 mapped directly to the Russian phone number +79602347275. Analysis by IntelHawk revealed that this telephone number belongs to Yakovtsev’s biological sister, an asset Aleksey frequently utilized to register accounts across various web services, generating secondary emails such as [email protected] and [email protected].
5. Physical Footprint: Russian aviation and travel agency booking records—many of which have similarly suffered security incidents—confirm that Yakovtsev holds a master’s degree in computing and information systems (having attended grade school in Murmansk) and has frequently traveled between St. Petersburg and Sochi, Russia’s premier Black Sea resort city.

Official Statements and Industry Insights

The revelation of Yakovtsev’s identity highlights the growing convergence of artificial intelligence, stylometric analysis, and big-data breach correlation in modern cyber threat intelligence.

Leo Bogod, founder and Chief Technology Officer of IntelHawk, noted that an advanced algorithmic review of historical usernames, writing styles, and technical behaviors exposed a clear trajectory:

"An analysis of these interconnected identities demonstrates a distinct professional evolution—progressing from a novice arbitrageur and credit card fraudster during the 2018–2019 period into a highly sophisticated participant and orchestrator of complex cybercrime infrastructure between 2020 and 2023, marked by a decisive pivot toward malware distribution, botnet management, and resilient payment systems."

Independent tracking groups, such as the anonymous OSINT investigative account Gang Exposed, have independently verified these findings, crediting AI-assisted correlation platforms for bridging the gap between pseudonymous dark web personas and physical civil registries.

Despite formal inquiries and outreach attempts directed via his historical email addresses and phone contacts, Aleksey Yakovtsev could not be reached for comment prior to publication.

Future Outlook

The unmasking of Aleksey Yakovtsev as the mastermind behind Qilin marks a watershed moment in the ongoing battle against ransomware-as-a-service ecosystems. While Russian nationals operating within domestic borders frequently enjoy de facto immunity from local law enforcement extradition, public exposure severely degrades their operational longevity.

The erosion of anonymity forces threat actors into perpetual cycles of re-branding, fracturing established trust networks within forums like RAMP, Exploit, and XSS. Furthermore, as intelligence platforms like IntelHawk, Flashpoint, and Intel dataGenerator increasingly leverage state-level data leaks and cross-platform correlation, the psychological safety net of cybercrime administrators is rapidly disintegrating.

For Qilin, the burning of Haise’s historical aliases and the public disclosure of Yakovtsev’s real-world dossier—complete with educational background, familial ties, and travel habits—serves as a stark reminder to the cybercriminal underworld: in an era of persistent digital telemetry, true operational security is an illusion.