The Qilin ransomware group has emerged as one of the most dangerous threat actors on the global cybersecurity landscape. According to an investigation published on November 11, 2026, by KrebsOnSecurity, the criminal operation is allegedly run by a Russian national from Saint Petersburg.
Qilin: One of the Most Active Ransomware Operations of 2026
365 Victims in Three Months: By the Numbers
Qilin has claimed at least 365 victims over the past three months — an extraordinarily high volume of activity that places the group among the most prolific ransomware-as-a-service operations currently in circulation.
It is worth noting that “claimed victims” does not automatically equate to “confirmed compromises.” Leak site postings should always be independently verified by third-party organizations or the affected companies themselves. Even so, and accounting for a margin of error, the volume remains deeply alarming.
The Ransomware-as-a-Service Model
Qilin operates as a criminal affiliate program. The core team provides the malware, technical infrastructure, affiliate recruitment, and payment coordination. The actual intrusions, however, are carried out by affiliates.
This model has direct implications for CISOs. There is no single attacker profile to defend against. Different affiliates use different techniques, target different sectors, and exploit different access vectors. As a result, no organization can consider itself safe simply because of the industry it operates in.
Attribution: Who Is the Alleged Qilin Administrator?
Digital Identities: Haise, Alexbigboss44, and Rjun
The KrebsOnSecurity investigation, backed by data from Intel 471, identifies the alleged Qilin administrator through a chain of aliases. The threat actor is said to operate under the nicknames “Haise” and “Alexbigboss44”, both of which are historically linked to the alias “Rjun” and the email address mail-30a@mail.ru.
These digital breadcrumbs lead to a name: Aleksey Mikhailovich Yakovtsev, 36, reportedly residing in Saint Petersburg, Russia.
The Limits of Attribution
That said, a critical reading of these findings is essential. This attribution remains an investigative assessment — not a confirmed identification by law enforcement. The report also does not establish that this individual personally carried out every attack.
In this context, the value of such attribution is strategic rather than operational. It helps analysts understand the group’s organizational structure and allows intelligence agencies to better direct their efforts. It should not, however, be treated as a legal indictment.
How to Defend Against Affiliate-Driven Ransomware Threats
Reducing the Exposed Attack Surface
Qilin’s affiliate model means the attack vector can vary enormously from one intrusion to the next. Defense, therefore, must be structural rather than reactive. Organizations should prioritize:
- Rapid patch management for all internet-facing systems.
- Securing VPNs and remote access tools with phishing-resistant multi-factor authentication.
- Network segmentation: identity servers, backup systems, and production environments should not communicate freely.
- Applying the principle of least privilege across all accounts, particularly administrative ones.
Continuous monitoring remains equally indispensable. Anomalous authentication attempts, privilege escalation, lateral movement, and data staging are all early warning signs of an active compromise.
Backups, Incident Response, and Executive Decision-Making
One often-overlooked but critical point: offline and immutable backups are the single most effective resilience measure available. Ransomware cannot encrypt what it cannot reach.
Alongside this, every organization must maintain an up-to-date incident response plan. That plan should clearly define decision-making authority at the executive level, include legal and regulatory contacts, establish channels to law enforcement, and outline both internal and external communication procedures.
Security investment should therefore focus on:
- Identity protection and privileged access management.
- Endpoint Detection and Response (EDR) with 24/7 coverage.
- Centralized logging and real-time alert handling capabilities.
- Continuous vulnerability management.
- Regular tabletop exercises to stress-test real-world response readiness.
Conclusions
The Qilin case is a stark reminder that behind every ransomware operation stand real individuals, defined organizational structures, and sophisticated business models. Public attribution carries significant deterrent and informational value.
For security leaders and CISOs, the message is unambiguous: Qilin does not select victims based on sector. It selects opportunities. Organizational resilience is the only structurally sound response.
Source: KrebsOnSecurity – Who Runs the Ransomware Group Qilin?
Source: Original article
The Qilin case underscores just how critical timely threat intelligence sharing has become for organizations seeking to get ahead of increasingly aggressive affiliate ransomware campaigns. Platforms like IsacChain enable the secure, traceable exchange of indicators of compromise between ISACs and enterprises, while simultaneously automating NIS2 compliance workflows and reducing the operational burden on security teams. Integrated blockchain verification ensures the integrity and provenance of every shared data point, making intelligence both trustworthy and tamper-proof. Discover how IsacChain can help your organization at www.isacchain.com