The cybercrime ecosystem thrives on anonymity, pseudo-identities, and the careful compartmentalization of digital footprints. Yet, even the most industrious threat actors operating within the heavily protected networks of Russian-speaking underground forums eventually leave traces behind. In the high-stakes world of modern cyber extortion, a single slip in operational security—spanning years of forum posts, reused handles, and catastrophic data breaches—can unravel an entire criminal enterprise.

This reality has recently caught up with the administrator of the world’s most active ransomware affiliate program. Known widely by the moniker “Haise,” the leader of the Russia-based ransomware gang Qilin has been unmasked. According to a convergence of cyber intelligence data, leaked government databases, and advanced stylistic analysis, the man behind the operation is a 36-year-old resident of St. Petersburg, Russia, named Aleksey Mikhailovich Yakovtsev.

The identification of Haise follows a sharp rise in Qilin’s operational output. Operating since September 2002—correcting for the group’s foundational timeline established in late 2022—the Russia-based ransomware-as-a-service gang has emerged as an industrial-scale threat. According to an intelligence report published by cybersecurity firm NCC Group, Qilin claimed at least 365 victim organizations in just a three-month window. This prolific activity cements its status as the most industrious ransomware operation currently active, outpacing several competing syndicates.

For context on the broader threat landscape, KrebsOnSecurity profiled the administrator of the second most active ransomware group, known as The Gentlemen, earlier in the year. While various ransomware gangs utilize different models, Qilin sustains its massive network of affiliates through a lucrative profit-sharing structure. The group offers affiliates at least 80 percent of any extortion payment extracted from victim organizations.

Like many top-tier modern cybercrime outfits, Qilin members practice the "double extortion" model. This technique involves infiltrating a corporate network, quietly exfiltrating sensitive data, and then encrypting internal systems. If a victim refuses to pay the ransom, the gang threatens to leak the stolen proprietary and confidential files onto public extortion portals. However, Qilin distinguishes itself from many traditional Russian ransomware partnerships by aggressively courting English-speaking affiliates. Haise has openly boasted on Telegram about collaborating with high-profile, western-leaning cybercrime entities, including the notorious extortion collective Scattered Spider and the RansomHub affiliate network.

Maintaining control over such a sprawling, high-risk criminal enterprise requires strict operational security, commonly referred to as "opsec." It is standard practice for cybercriminals to periodically cycle through handles and nicknames. This rotation is designed to sever ties with older digital identities that may have been compromised or linked back to a real-world person due to casual habits or poor compartmentalization.

Despite these precautions, operational realities often force criminals to reference their historical monikers. When applying for membership on heavily guarded, elite cybercrime forums, applicants must often prove their pedigree or past associations to forum administrators. Consequently, when those forums are eventually compromised, infiltrated, or seized by law enforcement agencies, they leave behind a goldmine of historical metadata for intelligence analysts.

That precise vulnerability led to the unraveling of Haise’s true identity. According to records maintained by the cyber intelligence platform Intel 471, a user operating under the handle Haise applied for membership in June 2022 to RAMP, a deeply secretive Russian-language cybercrime forum specifically designed as a haven for ransomware affiliate programs. The forum itself was eventually seized by the FBI. Indexed direct messages retrieved from RAMP show that the forum’s administrator formally approved Haise’s application. During the vetting process, the administrator explicitly linked the handle to a specific Telegram username: Alexbigboss44.

Delving deeper into historical forum archives through Intel 471 reveals that the Telegram account name Alexbigboss44 was previously shared by a user named “Rjun” on prominent Russian cybercrime forums Exploit and XSS two years earlier, in 2020. Another cyber intelligence platform, Flashpoint, notes that Alexbigboss44 was a prolific participant across various cybercriminal forums and Telegram channels. The user’s early activities primarily centered on the illicit trade of web traffic, browser logs, and corporate network access.

According to Flashpoint’s analysis, this user was heavily engaged in the high-volume acquisition of Facebook logs and Google Ads accounts to facilitate large-scale fraudulent advertising and illegal gambling schemes. Operating as both a broker and an administrator, Rjun managed a sprawling network of traffickers and purchased compromised credentials to fuel automated financial fraud operations before pivoting deeper into the ransomware ecosystem.

The definitive bridge linking the Qilin administrator Haise to the older Rjun and Alexbigboss44 accounts was mapped out publicly and privately by IntelHawk, an artificial intelligence-based platform specializing in the de-anonymization of threat actors through historical username correlation, stylometry, and behavioral signals. IntelHawk founder and chief technology officer Leo Bogod explained that an exhaustive analysis of these digital personas demonstrates a clear professional evolution. The data shows a progression from a novice traffic arbitrageur and credit card fraudster between 2018 and 2019 into a sophisticated organizer of complex cybercrime operations between 2020 and 2023, accompanied by an escalating focus on malicious software, botnet architecture, and illicit payment infrastructure.

Following this thread further into the historical records indexed by Intel 471 reveals that by the time Alexbigboss44 was petitioning for entry into RAMP, Rjun was already a long-standing member of several older Russian criminal forums, including Darkmarket, Verified, and Zloy. Crucially, records show that Rjun registered across all of these foundational sites using a single email address: [email protected].

This email address became a pivotal node in the de-anonymization chain. Identity threat protection firm SpyCloud identified that the [email protected] address had previously utilized the account password "Rjun132." Furthermore, a search for that exact email address within the breach tracking repositories maintained by Constella Intelligence showed that it appeared in records originating from gosuslugi.ru, the official digital government portal for state and municipal services in the Russian Federation.

The Gosuslugi platform suffered a massive data breach, reportedly exposing more than 20 million citizen records containing full legal names, dates of birth, and associated mobile phone numbers. According to the leaked Gosuslugi records analyzed via Constella, the email address [email protected] officially belongs to a 36-year-old man named Aleksey Mikhailovich Yakovtsev, a resident of St. Petersburg, Russia.

Additional corroborating data paints a detailed picture of Yakovtsev’s background and digital footprint. Flashpoint records indicate that Haise has long operated a specific Telegram account assigned the unique internal user ID 118329521, logging more than 5,000 individual messages from the profile dating back to 2018. Educational records obtained from Russia’s federal education watchdog, Rosobrnadzor, confirm that Yakovtsev spent his grade school years in Murmansk and later earned a master’s degree in computing and information systems.

Running a search on that same Telegram user ID within Constella’s breach databases links the profile directly to the Russian mobile phone number +79602347275. Pivoting on that specific phone number uncovers additional associated email addresses, including [email protected] and [email protected]. According to IntelHawk’s analysis, the phone number formally belongs to Yakovtsev’s biological sister, and Aleksey frequently utilized his sister’s contact details and email addresses when registering accounts across various web services over the years.

The phone number also surfaces within airline flight manifests obtained from Russian travel agencies that have suffered data security breaches. These travel records show that Aleksey Yakovtsev, born on August 18, 1990, traveled by air between St. Petersburg and Murmansk on multiple occasions between 2013 and 2014.

More recent flight manifests indicate that while Yakovtsev has avoided international air travel outside of Russia, he maintains a routine travel schedule between St. Petersburg and Sochi. Frequently referred to as the "Russian Riviera," Sochi is Russia’s largest resort city, located along the coast of the Black Sea roughly 1,200 miles south of St. Petersburg.

Attempts by security researchers and journalists to contact Mr. Yakovtsev via his identified email addresses and phone numbers were unsuccessful.

Independent verification of these findings has also emerged from external investigative channels. "Gang Exposed," an anonymous independent research account on X (formerly Twitter) with a documented history of successfully deanonymizing prominent ransomware actors, reached identical conclusions regarding Haise’s real-world identity, explicitly crediting IntelHawk’s analytical platform for helping connect the fragmented digital puzzle pieces.