Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarAmeer Owda

Leaker names alleged Qilin administrator Haise

Part of the Qilin story · since 18 Sep 2025

Developinglatest 7 hours ago37 articles11 outlets
18 Sep · GBHackers first12 Apr21 Jun30 AugNowThis article37th of 37
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare.
  • Fri 6 Nov, 10:30 UTC. SOCRadar. Leaker names alleged Qilin administrator Haise. This article, 37th of 37.

GangExposed, the anonymous leaker who previously exposed Conti and Trickbot leadership, has published a post naming a Russian national as “Haise”, the long-standing administrator persona behind Qilin’s affiliate programme since 2022. The article notes that no public authority has confirmed this identification, and Germany’s October 2026 arrest of a Russian national suspected of being a leading Qilin member has not been linked to Haise.

The piece emphasises that the evidence rests on a chain of forum records, Telegram history and leaked Russian databases, with no independent verification.

The investigation traces Haise’s public role back to May 2022 on the RAMP forum, where the Qilin affiliate programme was advertised by February 2023. It recounts the disclosed affiliate economics (80% of ransom up to USD 3 million, 85% above that) and Haise’s explanations of how ransoms flow through affiliates before operators take their share, including the 2025 “call lawyer” feature.

The article also details a Telegram account active from 2018 to 2024 that allegedly recruited pentesters and queried evasion of security controls, and links to Qilin advertisements in mid-2024. It notes Qilin remains active, listing more than 2,350 known victims across 62 countries, with more than 450 victims added since June 2026, despite a declining leak site volume and the October arrest. The piece treats Haise’s unmasking as a credible lead that requires independent confirmation.

How the story developed

All 37 articles
Developinglatest 7 hours ago37 articles11 outlets

37 articles from 11 outlets since 18 Sep. Picked up again today after 7 days quiet. This was the 37th report, 414 days after the first.

Now18 Sep5262127 Mar2231662721112First reportGBHackers · 18 Sep, 13:36This article37th of 37 · day 414Exploited CVEDark Reading · 8 Jun
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare.
  • Fri 6 Nov, 10:30 UTC. SOCRadar. Leaker names alleged Qilin administrator Haise. This article, 37th of 37.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 37 articles as a list
  1. Thu 18 SepDay 01
    1. Qilin Ransomware Attack Impacts 104 Organizations in August13:36 · GBHackers · First report

  2. Quiet for 3 weeks

    Wed 8 OctDay 203
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · Picked up again
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches

  3. Quiet for 11 weeks

    Tue 23 DecDay 961
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  4. Quiet for 14 weeks

    Tue 31 MarDay 1941
    1. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc08:06 · Security Affairs · Picked up again

  5. Quiet for 4 days

    Sat 4 AprDay 1981
    1. Qilin Ransomware Claims Data Theft from German Party Die Linke18:10 · Security Affairs · Picked up again

  6. Quiet for 2 weeks

    Sun 19 AprDay 2131
    1. NHS Trust still using paper after Qilin ransomware hit Synnovis18:08 · DataBreaches · Picked up again

  7. Quiet for 3 weeks

    Mon 11 MayDay 2351
    1. Qilin Tops Ransomware List as Gentlemen Surge in Q1 202610:27 · Check Point · Picked up again

  8. Quiet for 3 weeks

    Wed 3 JunDay 2581
    1. Brazil faces surge in ransomware as top threat actors target 202612:06 · SOCRadar · Picked up again

  9. Quiet for 5 days

    Mon 8 JunDay 2631
    1. Check Point warns of IKEv1 flaw linked to Qilin ransomware20:57 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE
  10. Tue 9 JunDay 2643
    1. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks09:50 · SecurityWeek · Known exploited CVE
    2. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild09:50 · Infosecurity · Known exploited CVE
    3. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN12:31 · DataBreaches · Known exploited CVE

  11. Quiet for 3 weeks

    Fri 3 JulDay 2881
    1. Qilin Tops Ransomware Market Rising Competition, Analysts Say13:11 · Infosecurity · Picked up again

  12. Quiet for 3 weeks

    Tue 21 JulDay 3063
    1. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall03:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin ransomware exploits PAN-OS auth bypass to breach networks14:10 · The Hacker News
    3. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN17:01 · Security Affairs · Known exploited CVE

  13. Quiet for 2 days

    Thu 23 JulDay 3081
    1. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass09:09 · SecurityWeek · Known exploited CVE

  14. Quiet for 4 days

    Mon 27 JulDay 3121
    1. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations07:12 · Security Affairs · Picked up again

  15. Quiet for 4 days

    Fri 31 JulDay 3161
    1. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 202617:20 · DataBreaches · Picked up again

  16. Quiet for 7 days

    Fri 7 AugDay 3231
    1. Ransomware Surges in July After Q2 Lull08:31 · Infosecurity · Picked up again

  17. Quiet for 3 days

    Mon 10 AugDay 3261
    1. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge10:17 · Securelist · Picked up again

  18. Quiet for 2 weeks

    Thu 27 AugDay 3431
    1. Qilin ransomware claims ATF hack, agency says breach isolated17:25 · DataBreaches · Picked up again
  19. Fri 28 AugDay 3441
    1. ATF calls Qilin ransomware breach a major incident14:18 · SecurityWeek

  20. Quiet for 13 days

    Thu 10 SepDay 3571
    1. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Picked up again · Known exploited CVE
  21. Fri 11 SepDay 3581
    1. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE

  22. Quiet for 4 weeks

    Tue 6 OctDay 3831
    1. Japan Extradites Suspected Qilin Ransomware Member to Germany12:29 · DataBreaches · Picked up again
  23. Wed 7 OctDay 3841
    1. Alleged Qilin ransomware operator extradited from Japan to Germany13:54 · SecurityWeek · Known exploited CVE

  24. Quiet for 2 days

    Fri 9 OctDay 3861
    1. Germany Arrests Suspected Qilin Ransomware Leader After Extradition20:00 · Security Affairs · Picked up again

  25. Quiet for 3 days

    Mon 12 OctDay 3891
    1. Ransomware gangs exploit Palo Alto VPN flaw months after patch release09:46 · Infosecurity · Picked up again · Known exploited CVE

  26. Quiet for 8 days

    Tue 20 OctDay 3973
    1. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
    3. Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE
  27. Wed 21 OctDay 3981
    1. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption12:22 · Infosecurity

  28. Quiet for 9 days

    Fri 30 OctDay 4071
    1. Acronis details Qilin ransomware attacks on ESXi and healthcare07:00 · SecurityOnline · Picked up again

  29. Quiet for 7 days

    Fri 6 NovDay 4141
    1. Leaker names alleged Qilin administrator Haise10:30 · SOCRadar · Picked up again · This article, 37th of 37

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in