{
  "id": 19530855,
  "title": "Who Runs the Ransomware Group Qilin?",
  "url": "https://urgent.news/2026/11/11/who-runs-the-ransomware-group-qilin",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T18:06:01.000Z",
  "source": {
    "name": "KrebsOnSecurity",
    "slug": "krebsonsecurity",
    "url": "https://krebsonsecurity.com/2026/11/who-runs-the-ransomware-group-qilin/"
  },
  "original_language": "en",
  "account": "The most prolific ransomware group, Qilin, operates out of St. Petersburg, Russia, with its administrator identified as a 36-year-old man named Aleksey Mikhailovich Yakovtsev. Over the past three months, Qilin has targeted at least 365 organizations globally. The group employs a \"double extortion\" model, stealing sensitive data before deploying ransomware, threatening to release the stolen information online. Unlike most Russian-based ransomware affiliates, Qilin welcomes English-speaking members. The group's leader, operating under the handle \"Haise,\" has had a history of changing his online monikers, a common operational security measure for cybercriminals. These aliases include \"Rjun\" and \"Alexbigboss44\" on various Russian cybercrime forums. The connection between these identities led IntelHawk to identify the administrator as Aleksey Yakovtsev, born in St. Petersburg in 1989 and holding a master's degree in computing and information systems.",
  "summary": "The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.",
  "key_points": [
    "Qilin ransomware group operates from St. Petersburg, Russia.",
    "Leader Aleksey Yakovtsev, 36, has history of changing online names.",
    "Group uses double extortion model, targets 365+ organizations."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}