Summary

Qilin operates as a structured ransomware-as-a-service organization, with administrators, affiliates, developers and dedicated infrastructure. One alias appears repeatedly in its public-facing activity: Haise. The IntelHawk investigation describes Qilin as the most active ransomware group of 2025–2026 by victim count and examines who may be behind that alias. [1]

The investigation follows two connected routes. The first starts with RAMP approval records, passes through Exploit and XSS profiles, and follows a recurring email address into historical records. The second starts with the proposed real-world identity and works back through contact associations, a Telegram account, ransomware-related messages and Qilin advertisements.

The report identifies Alexey Mikhailovich Yakovtsev as the person behind Haise and assigns high confidence to that conclusion. That is IntelHawk’s attribution, not an independently established identity finding by this adaptation. The sections below preserve the underlying account references, dated records, message history and supporting materials that the report presents.

Haise: Qilin’s Public Administrator

According to the investigation, Haise appeared on RAMP on May 29, 2022. By February 2023, the account was openly advertising Qilin’s affiliate program. In July 2023, Haise described an affiliate-first financial arrangement: ransom payments went to affiliates’ wallets, after which affiliates transferred the operators’ share, typically 15–20%. [1]

The account continued recruiting on RAMP in July 2024. On April 1, 2025, Haise announced a new ransomware release and a DDoS feature in the affiliate panel. In June 2025, the account promoted the “Call lawyer” option, which the IntelHawk report describes as a mechanism for increasing pressure during ransom negotiations.

IntelHawk’s report names Group-IB, SANS and Halcyon among the organizations that have described Haise as an administrator or key Qilin operator. This public role is the starting point of the investigation. Connecting that persona to other accounts, and then to a person, is the separate task addressed by the remaining records.

From the Haise Alias to Profiles on Other Forums

The report describes RAMP as a closed criminal forum without open registration. New participants had to provide profiles from other hacking forums or pay a $400 cryptocurrency entry fee. Accounts were activated after verification. [1]

The administrator, admin, and an assistant, Nowheretogo, coordinated approvals through private messages. The assistant submitted applicant lists alongside existing forum profiles; the administrator then confirmed which accounts had been activated.

Haise appears twice in the reproduced approval records. The first exchange links the alias, by its position in the lists, to Exploit profile /profile/113584-alexbigboss44/. The second links it to XSS member /members/177186/.

The first record: June 3, 2022

At 17:42:51 UTC, Nowheretogo submitted ten RAMP applicants followed by ten Exploit profiles in message 1990. Haise is ninth in the applicant list; the ninth Exploit profile is alexbigboss44. The table preserves all ten entries in the order supplied.

In a follow-up at 17:48:12 UTC, message 1993, the assistant also requested approval for Stillam, described as an Exploit forum coder. On June 4 at 20:19:50 UTC, the administrator responded in message 1996 that everyone, including Stillam, had been approved except Swift, because no user named Swift was found.

[2022-06-03 17:42:51 UTC] Nowheretogo (12) | message_id=1990
============================================================
Please approve--->>> SpLo1t, topbood, Amandirey, Undermine, odinsmokes, W999a!, polosatiy77,
sourskittles, haise, Swift.
============================================================
Profile Exp:

/profile/55267-redsnow/
/profile/130542-goodshmoneyy/
/profile/110612-amandirey/
/profile/120883-undermine/
/profile/125444-0dinsmokes/
/profile/124656-69pdf/
/profile/106300-polosatiy/
/profile/103729-tngrak/
/profile/113584-alexbigboss44/
/profile/130415-swift_/

[2022-06-03 17:48:12 UTC] Nowheretogo (12) | message_id=1993
I invited Bank Injector and Sql injector Coder name "[B]Stillam[/B]" from Exploit forum
his Ramp nick also same --->>[B]Stillam

waiting approval[/B]

[2022-06-04 20:19:50 UTC] admin (1) | message_id=1996
Have approved everyone, and [B]Stillam too, EXCEPT Swift. No user Swift found[/B]

The second record: June 21, 2022

At 11:57:27 UTC, Nowheretogo submitted nineteen applicants and nineteen XSS profiles in message 2104. Haise is fifth in the applicant list; the corresponding fifth profile is /members/177186/. IntelHawk’s report identifies that XSS account as Rjun.

The administrator’s response, message 2106 at 14:44:08 UTC, records activations and corrections to several applicant names. It explicitly states that odinsmokes, topbood and Haise were already activated.

[2022-06-21 11:57:27 UTC] Nowheretogo (12) | message_id=2104
===============================================================
Please Approve --->>> Choppi77, odinsmokes, topbood, soibten.2210, "Haise, ggho5t, Anunnack, lighter133,
===============================================================
r3dru9, cortexxx.2257, Morovic, b4ssb4b33, doodoonow.2186, ZEON, MNSTR, killerAV, coomboy, braked.2312, Perecrestock
================================================================

[B]Xss Profile:[/B]

/members/215839/
/members/255039/
/members/264274/
/members/238719/
/members/177186/
/members/264570/
/members/239042/
/members/256639/
/members/258722/
/members/233888/
/members/212682/
/members/217424/
/members/264240/
/members/209317/
/members/181544/
/members/190951/
/members/257475/
/members/260430/
/members/239820/

[2022-06-21 14:44:08 UTC] admin (1) | message_id=2106
Have activated: Choppi77, soibten.2210 (no soibten.2210, I actvated soibten), ggho5t, Anunnack, lighter133, r3dru9, cortexxx.2257 (no cortexxx.2257, I activated cortexxx), Morovic, b4ssb4b33, doodoonow.2186 (no doodoonow.2186, I activated doodoonow), ZEON, MNSTR, killerAV, coomboy, braked.2312 (no braked.2312, I activated braked), no user Perecrestock, I acticated pereckrestock
were already activated, i did nothing on those: odinsmokes, topbood, Haise

Connecting alexbigboss44 and Rjun

The account cluster does not stop with the XSS record. The IntelHawk reports that the user behind Exploit profile /profile/113584-alexbigboss44/ listed Telegram contact @alexbigboss44 in another Exploit account, /profile/84170-rjun/.

The report treats the XSS username and this shared contact as confirmation that Rjun is another alias associated with Haise. IntelHawk’s proposed cluster is therefore Haise → alexbigboss44 → Rjun, supported by the two approval exchanges and the cross-profile contact association.

The applicant-to-profile associations above follow the ordering reproduced in the IntelHawk report. Original ordering and record completeness are material to that mapping.

From the Rjun Alias to an Email Address

The next step moves from usernames to a recurring contact identifier. The IntelHawk reports that a BHF forum record associated with Rjun contains [email protected]. It then finds the same email in a Zloy forum registration under Rjun123. [1]

The Zloy entry carries a registration date of December 9, 2015. IntelHawk’s report describes the surrounding archive as a 2016 leak containing approximately 25,000 accounts, with usernames, email addresses, IP addresses, registration and activity information, and salted MD5 password hashes.

In the report’s chain, the recurring email is the link between the Rjun account history and the subsequent identity record. The earlier registration also places that identifier several years before Haise’s documented Qilin recruitment activity.

From the Email Address to a Real Person

The investigation reports that [email protected] also appears in a leaked dataset associated with Russia’s public-services portal. The accompanying narrative says the dataset began circulating in early 2025 and reportedly contained approximately 180 million records. The reproduced entry itself is labeled “Gosuslugi 2024.” [1]

IntelHawk’s report describes the dataset as including names, telephone numbers, email addresses, tax identifiers, SNILS numbers, passport information and residential addresses. In the record it reproduces, the recurring email is associated with Alexey Mikhailovich Yakovtsev. The report states his date of birth as August 18, 1990.

This is the point at which the investigation moves from an account cluster to a proposed real-world identity. IntelHawk’s report treats the email match as the identifying link; this article retains that conclusion as the report’s claim rather than presenting the leaked record as independently authenticated.

The IntelHawk report also references two photographs, dated 2010 and 2015, described as obtained through Himera Search Pro. Those photograph files were not available in the supplied materials and are not reproduced here.

The Overall Investigative Chain

The forward route described by the report can be summarized as follows:

The investigation graph below brings the linked accounts and identifiers together in IntelHawk.ai. The report then tests the proposed identity in the opposite direction by following contact associations toward activity within the ransomware ecosystem. [1]

Reverse Chain: From Yakovtsev’s Identity to the Ransomware Ecosystem

The reverse examination starts with the full name and date of birth attributed to Yakovtsev. The report describes a search using @Sherlock_GangIntel_bot that identifies a relative whom it names as his biological sister. A telephone number registered to that relative is then associated with two email addresses and a Telegram account. [1]

The reported email associations are [email protected] and [email protected]. The second address repeats the Rjun alias. The associated Telegram account is @kaperniiki, numeric ID 118329521.

The family relationship and telephone-registration link are part of IntelHawk’s attribution argument. The relative’s name, birth date and telephone number are withheld here; the relationship, account identifiers and dates relevant to the argument are retained.

Telegram Account Activity

IntelHawk’s report lists the Telegram account as deleted and says its public group messages span September 15, 2018 to July 29, 2024. It identifies @imsg_bot as the IntelHawk report of the message history for account 118329521. The translated excerpts reproduced below are from 2023 and 2024. [1]

Ransomware-related discussions

The report highlights participation in the Ransomware Developers group, questions about endpoint-detection-and-response products such as CrowdStrike, searches for ransomware source code, and discussion of locker development. These messages are reproduced as evidence of the account’s interests, not as technical instructions.

Technical development and recruitment

Other messages ask about the ESXi kernel and libraries written in pure C. An April 8, 2023 recruitment post seeks penetration testers working across Windows, Linux, ARM, NAS and ESXi, describes new software and favorable terms, and requests initial contact by private message.

Underground platforms and corporate targets

The account asks about Chinese platforms similar to RAMP, mentions XSS, and seeks forums used by penetration testers beyond Exploit, XSS and RAMP. Other excerpts discuss corporate targets and changes in payouts.

“Who works with corporate targets?”

Source translation, August 26, 2023 · Ransomware Developers · message 27635

Complete translated message list

All 27 English-language entries in the IntelHawk report are retained below, in IntelHawk’s order. The translations, including incomplete or ambiguous phrases, have not been silently corrected. Message links are included where the IntelHawk report supplied them.

Дата	id сообщения	Текст сообщения	Название группы
13:56:55 29.07.2024	https://telegram.me/CobaltStrikeGroup/4229	I understand they	Cobalt Strikers | Group
13:56:06 29.07.2024	https://telegram.me/CobaltStrikeGroup/4228	 Qilin, RansomHub ransomware added to Scattered Spider arsenal

https://malware.news/t/qilin-ransomhub-ransomware-added-to-scattered-spider-arsenal/84195	Cobalt Strikers | Group
19:15:07 01.08.2023	https://telegram.me/ProCxx/580559	ребят кто хорошо знает как работает ядро esxi или как обойти проблему сменив архитектуру приложения	pro.cxx
22:24:42 12.07.2023	https://telegram.me/ProCxx/576190	Вечер добрый ребят кто нибудь пишет либы на чистом С ?	pro.cxx
10:06:04 08.04.2023	189296	Ищем пентестеров WIN/LIN/ARM/NAS/ESXi

Отличные условия, совершенно новый софт
Нужны опытные пентестеры
Первый контакт в ПМ	Рынок "1-ый Нелегальный"
06:39:26 29.07.2024	https://telegram.me/ransomwaredevs/52744	eldorado can't even be called a locker )	Ransomware Developers
14:02:39 28.07.2024	https://telegram.me/ransomwaredevs/52669	скинь в личку	Ransomware Developers
14:02:01 28.07.2024	https://telegram.me/ransomwaredevs/52667	китайский площадок нету на подобе рампы?	Ransomware Developers
10:40:56 24.10.2023	https://telegram.me/ransomwaredevs/31132	вроде срач был на хсс по этому поводу	Ransomware Developers
10:40:34 24.10.2023	https://telegram.me/ransomwaredevs/31131	а не кодер случаем первый слил билд?	Ransomware Developers
18:33:15 26.08.2023	https://telegram.me/ransomwaredevs/27635	кто по корпам работает?	Ransomware Developers
14:38:44 10.08.2023	https://telegram.me/ransomwaredevs/27239	Ну если бы его только в ручную отрубали тогда сетки мертвым грузом с ним лежали , а их покупают	Ransomware Developers
14:36:54 10.08.2023	https://telegram.me/ransomwaredevs/27232	да и через инсталлы, сплойты , брут Единственное пока с почтовиками не разобрался	Ransomware Developers
14:34:25 10.08.2023	https://telegram.me/ransomwaredevs/27228	пока ищу кто с этим ав работает	Ransomware Developers
14:31:52 10.08.2023	https://telegram.me/ransomwaredevs/27221	как то же отрубают или обходят не понятно как Причем корпы именно с этим ав покупают	Ransomware Developers
14:27:01 10.08.2023	https://telegram.me/ransomwaredevs/27216	CrowdStrike кто не будь обходил без токена?	Ransomware Developers
17:45:29 10.07.2023	https://telegram.me/ransomwaredevs/26109	никто исходники линокса с эскси не видел на гитхабе ранса ?	Ransomware Developers
23:13:11 08.07.2023	https://telegram.me/ransomwaredevs/26026	ДНС домен конечно подсвечивает но держиться херого и длл не прогрузить в память только роняю на стол	Ransomware Developers
23:12:04 08.07.2023	https://telegram.me/ransomwaredevs/26024	амадей чет не фантан	Ransomware Developers
14:03:18 08.07.2023	https://telegram.me/ransomwaredevs/25585	вот я и говорю если файлы зашифрованы пятнами по всему файлу , скорее всего он выдерет только куски	Ransomware Developers
10:34:49 21.04.2024	101205	на сентинел нету ?	Ralf Hacker Public Chat
14:19:37 10.08.2023	96279	ребят как отключить CrowdStrike	Ralf Hacker Public Chat
16:59:27 14.05.2023	94765	есть у кого китайские форумы на подобе рампа?	Ralf Hacker Public Chat
16:41:12 13.05.2023	94691	хотел уточнить выплаты у всех просели или нет)	Ralf Hacker Public Chat
16:40:15 13.05.2023	94689	кто ни будь по корпам шевелиться?	Ralf Hacker Public Chat
11:00:09 10.04.2023	42099	а те где рансы можно?)	COOCKIE.PRO | CHAT PUBLIC
10:40:46 10.04.2023	42093	есть у кого список форумов где пентестеры сидят по мимо экспы , хсс , рамп?	COOCKIE.PRO | CHAT PUBLIC

The July 29 news-sharing message includes the word “Source” in the supplied translation. Its accompanying news reference is preserved in the IntelHawk report materials below; no missing context has been added to the other excerpts.

Temporal and Contextual Match: Qilin Advertising

On July 29, 2024, message 4228 in the Cobalt Strikers group shared the headline “Qilin, RansomHub ransomware added to Scattered Spider arsenal.” IntelHawk’s report then describes a Qilin commercial advertisement appearing in that same group about one week later. It offered an affiliate opportunity, outlined the group’s advantages and supplied a Tox contact. [1]

The report says a search for that Tox identifier across Telegram channels returned four results. It lists similar advertisements in groups where the attributed account was present on the following dates:

IntelHawk’s report provides two example message references: Ransomware Developers, message 52746, and Cobalt Strikers, message 4359.

It also claims that Qilin did not appear in those groups before or after the cited advertisements, based on searches of the groups’ message histories. That absence claim is retained as IntelHawk’s statement; the complete histories were not independently reviewed for this adaptation.

Within the investigation, this section provides a temporal and community-level connection between the Telegram account’s activity and Qilin recruitment. The actual Tox identifier is not present in the supplied text, so no identifier has been invented or inserted.

Confirmation of Account Ownership: IntelHawk’s Assessment

IntelHawk’s report uses a Beeline subscriber record to support its account-ownership conclusion. It states that the number associated with the Telegram account was registered to the relative identified as Yakovtsev’s sister from March 20, 2015 to October 24, 2018. The reproduced registration information includes a residential address in Murmansk, which is redacted here. [1]

According to the report’s account statistics, the Telegram account existed no later than September 15, 2018, the date of its first cited group message. That date falls inside the registration period described for the telephone number.

IntelHawk’s report concludes that Yakovtsev used the account during its active period. The temporal overlap is the stated support for that conclusion; a subscriber record and a first-message date do not, by themselves, independently establish who operated an account. The distinction between IntelHawk’s conclusion and the reproduced record is retained here.

Conclusion

The investigation presents a forward attribution chain and a reverse contextual chain. The forward chain connects Haise to alexbigboss44 / Rjun, then to a recurring email and a named individual. The reverse chain connects that proposed identity to contact records, Telegram account 118329521, ransomware-related discussions, and Qilin advertisements in overlapping communities. [1]

IntelHawk’s report cites RAMP approval records, XSS and Exploit profiles, BHF and Zloy forum datasets, a public-services dataset, Beeline subscriber information, Telegram account statistics and public message histories. Taken together, it assesses with high confidence that Alexey Mikhailovich Yakovtsev is the person behind Haise, Qilin’s public-facing administrator.

That confidence assessment belongs to the investigation. The publication-ready account presented here preserves its substantive record and conclusion while keeping the status of the underlying identity allegation explicit. Independent authentication of the original records, dataset provenance and account control remains outside the scope of this formatting and editorial adaptation.

Supporting Report and Evidence Materials

The IntelHawk report links an evidence archive and lists the following files. The filenames are preserved as supplied; the archive contents have not been downloaded or independently reviewed for this page. [1]

Open the evidence archive linked by the IntelHawk report →

IntelHawk Research and Supporting References

[1] IntelHawk — Who Runs Qilin? Identifying Haise. Investigation records, dated account links, transcripts and translations presented in this article are drawn from the IntelHawk investigation.

Referenced news item. Qilin, RansomHub ransomware added to Scattered Spider arsenal — the news reference attached to the July 29 Telegram message in the IntelHawk report.

Image provenance. Figure 3 is an IntelHawk platform screenshot supplied for this article. Figures 1 and 2 are explanatory illustrations, not original evidence screenshots.

Redactions and verification. Private residential addresses, telephone numbers and government identifiers are omitted from the article text. The supplied platform screenshot is reproduced as provided. The reported name attribution, dataset sizes, group-history claims and account-control conclusions have not been independently verified for this adaptation.