Skip to content
OriginalSign in
Image: Krebs on Security

Krebs on SecurityBrianKrebs

Krebs traces Qilin ransomware boss to Russian cybercrime circles

Part of the Qilin story · since 18 Sep 2025

Developinglatest 18 hours ago39 articles12 outlets
18 Sep · GBHackers first15 Apr25 Jun4 SepNowThis article39th of 39
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare.
  • Fri 6 Nov, 10:30 UTC. SOCRadar. Leaker names alleged Qilin administrator Haise.
  • Tue 10 Nov, 09:00 UTC. Securelist. Kaspersky says Qilin accounted for 15% of ransomware victims. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 19:00 UTC. Krebs on Security, its first report on the story. Krebs traces Qilin ransomware boss to Russian cybercrime circles. This article, 39th of 39.

The ransomware group Qilin, described by KrebsOnSecurity as the world’s most active affiliate program, has been operating since September 2022 and reportedly recruited affiliates by offering at least 80 per cent of extortion proceeds. The group uses a double-extortion model, stealing data before encrypting systems and threatening to publish it.

Its administrator, who goes by the handle “Haise,” has allegedly collaborated with English-speaking affiliates and worked with groups such as Scattered Spider and RansomHub, according to NCC Group’s assessment cited by KrebsOnSecurity.

A wider investigation traces Haise to a longer trail of identities. Intel 471’s analysis links Haise to the Telegram handle Alexbigboss44 and to the name Rjun on Russian forums such as Exploit and XSS as far back as 2020. Spycloud and Flashpoint corroborate a pattern of high-volume data brokerage and compromised-credentials activity tied to the email mail-30a@mail[.]ru, with the Gosuslugi breach of late 2025 reportedly exposing over 20 million records.

IntelHawk’s private analysis, cited by KrebsOnSecurity, connects these identities to Aleksey Mikhailovich Yakovtsev of St. Petersburg, born 18 August 1990, and ties to a Telegram ID used since 2018, as well as to a Russian phone number that has appeared in flight records and other traces. The report notes attempts to reach Yakovtsev without success and mentions Gang Exposed as a separate source offering similar lines of inquiry.

How the story developed

All 39 articles
Developinglatest 18 hours ago39 articles12 outlets

39 articles from 12 outlets since 18 Sep. Still developing; the latest report was 18 hours ago. This was the 39th report, 419 days after the first.

Now18 Sep5272127 Mar2241772924177First reportGBHackers · 18 Sep, 13:36This article39th of 39 · day 419Exploited CVEDark Reading · 8 Jun
  • Thu 18 Sep, 13:36 UTC. GBHackers, first report. Qilin Ransomware Attack Impacts 104 Organizations in August.
  • Wed 8 Oct, 13:45 UTC. The Hacker News, its first report on the story. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 31 Mar, 08:06 UTC. Security Affairs. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc.
  • Sat 4 Apr, 18:10 UTC. Security Affairs. Qilin Ransomware Claims Data Theft from German Party Die Linke.
  • Sun 19 Apr, 18:08 UTC. DataBreaches. NHS Trust still using paper after Qilin ransomware hit Synnovis.
  • Mon 11 May, 10:27 UTC. Check Point, its first report on the story. Qilin Tops Ransomware List as Gentlemen Surge in Q1 2026.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Mon 8 Jun, 20:57 UTC. Dark Reading, its first report on the story. Check Point warns of IKEv1 flaw linked to Qilin ransomware. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. SecurityWeek, its first report on the story. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 09:50 UTC. Infosecurity, its first report on the story. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 9 Jun, 12:31 UTC. DataBreaches. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN. Cites a CVE in CISA KEV.
  • Fri 3 Jul, 13:11 UTC. Infosecurity. Qilin Tops Ransomware Market Rising Competition, Analysts Say.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 14:10 UTC. The Hacker News. Qilin ransomware exploits PAN-OS auth bypass to breach networks.
  • Tue 21 Jul, 17:01 UTC. Security Affairs. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 07:12 UTC. Security Affairs. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations.
  • Fri 31 Jul, 17:20 UTC. DataBreaches. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 2026.
  • Fri 7 Aug, 08:31 UTC. Infosecurity. Ransomware Surges in July After Q2 Lull.
  • Mon 10 Aug, 10:17 UTC. Securelist, its first report on the story. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge.
  • Thu 27 Aug, 17:25 UTC. DataBreaches. Qilin ransomware claims ATF hack, agency says breach isolated.
  • Fri 28 Aug, 14:18 UTC. SecurityWeek. ATF calls Qilin ransomware breach a major incident.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Fri 11 Sep, 10:37 UTC. Security Affairs. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware. Cites a CVE in CISA KEV.
  • Tue 6 Oct, 12:29 UTC. DataBreaches. Japan Extradites Suspected Qilin Ransomware Member to Germany.
  • Wed 7 Oct, 13:54 UTC. SecurityWeek. Alleged Qilin ransomware operator extradited from Japan to Germany. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 20:00 UTC. Security Affairs. Germany Arrests Suspected Qilin Ransomware Leader After Extradition.
  • Mon 12 Oct, 09:46 UTC. Infosecurity. Ransomware gangs exploit Palo Alto VPN flaw months after patch release. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 10:43 UTC. SecurityOnline. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:13 UTC. The Hacker News. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 16:48 UTC. DataBreaches. Ransomware gangs exploit patched Palo Alto VPN security flaw. Cites a CVE in CISA KEV.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Fri 30 Oct, 07:00 UTC. SecurityOnline. Acronis details Qilin ransomware attacks on ESXi and healthcare.
  • Fri 6 Nov, 10:30 UTC. SOCRadar. Leaker names alleged Qilin administrator Haise.
  • Tue 10 Nov, 09:00 UTC. Securelist. Kaspersky says Qilin accounted for 15% of ransomware victims. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 19:00 UTC. Krebs on Security, its first report on the story. Krebs traces Qilin ransomware boss to Russian cybercrime circles. This article, 39th of 39.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 39 articles as a list
  1. Thu 18 SepDay 01
    1. Qilin Ransomware Attack Impacts 104 Organizations in August13:36 · GBHackers · First report

  2. Quiet for 3 weeks

    Wed 8 OctDay 203
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · Picked up again
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches

  3. Quiet for 11 weeks

    Tue 23 DecDay 961
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  4. Quiet for 14 weeks

    Tue 31 MarDay 1941
    1. Qilin Ransomware allegedly breached chemical manufacturer giant Dow Inc08:06 · Security Affairs · Picked up again

  5. Quiet for 4 days

    Sat 4 AprDay 1981
    1. Qilin Ransomware Claims Data Theft from German Party Die Linke18:10 · Security Affairs · Picked up again

  6. Quiet for 2 weeks

    Sun 19 AprDay 2131
    1. NHS Trust still using paper after Qilin ransomware hit Synnovis18:08 · DataBreaches · Picked up again

  7. Quiet for 3 weeks

    Mon 11 MayDay 2351
    1. Qilin Tops Ransomware List as Gentlemen Surge in Q1 202610:27 · Check Point · Picked up again

  8. Quiet for 3 weeks

    Wed 3 JunDay 2581
    1. Brazil faces surge in ransomware as top threat actors target 202612:06 · SOCRadar · Picked up again

  9. Quiet for 5 days

    Mon 8 JunDay 2631
    1. Check Point warns of IKEv1 flaw linked to Qilin ransomware20:57 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE
  10. Tue 9 JunDay 2643
    1. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks09:50 · SecurityWeek · Known exploited CVE
    2. Check Point Warns Critical Auth Bypass Bug Exploited in the Wild09:50 · Infosecurity · Known exploited CVE
    3. U.S. Agencies Ordered to Patch CVE-2026-50751 in Check Point VPN12:31 · DataBreaches · Known exploited CVE

  11. Quiet for 3 weeks

    Fri 3 JulDay 2881
    1. Qilin Tops Ransomware Market Rising Competition, Analysts Say13:11 · Infosecurity · Picked up again

  12. Quiet for 3 weeks

    Tue 21 JulDay 3063
    1. Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall03:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin ransomware exploits PAN-OS auth bypass to breach networks14:10 · The Hacker News
    3. Qilin Ransomware Exploits CVE-2026-0257 in Palo Alto VPN17:01 · Security Affairs · Known exploited CVE

  13. Quiet for 2 days

    Thu 23 JulDay 3081
    1. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass09:09 · SecurityWeek · Known exploited CVE

  14. Quiet for 4 days

    Mon 27 JulDay 3121
    1. LockBit5 and Qilin Lead Ransomware Attacks Against Italian Organizations07:12 · Security Affairs · Picked up again

  15. Quiet for 4 days

    Fri 31 JulDay 3161
    1. LockBit5, Qilin and The Gentlemen lead Italy ransomware H1 202617:20 · DataBreaches · Picked up again

  16. Quiet for 7 days

    Fri 7 AugDay 3231
    1. Ransomware Surges in July After Q2 Lull08:31 · Infosecurity · Picked up again

  17. Quiet for 3 days

    Mon 10 AugDay 3261
    1. Kaspersky blocks 400M attacks in Q2 2026 amid ransomware surge10:17 · Securelist · Picked up again

  18. Quiet for 2 weeks

    Thu 27 AugDay 3431
    1. Qilin ransomware claims ATF hack, agency says breach isolated17:25 · DataBreaches · Picked up again
  19. Fri 28 AugDay 3441
    1. ATF calls Qilin ransomware breach a major incident14:18 · SecurityWeek

  20. Quiet for 13 days

    Thu 10 SepDay 3571
    1. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Picked up again · Known exploited CVE
  21. Fri 11 SepDay 3581
    1. Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:37 · Security Affairs · Known exploited CVE

  22. Quiet for 4 weeks

    Tue 6 OctDay 3831
    1. Japan Extradites Suspected Qilin Ransomware Member to Germany12:29 · DataBreaches · Picked up again
  23. Wed 7 OctDay 3841
    1. Alleged Qilin ransomware operator extradited from Japan to Germany13:54 · SecurityWeek · Known exploited CVE

  24. Quiet for 2 days

    Fri 9 OctDay 3861
    1. Germany Arrests Suspected Qilin Ransomware Leader After Extradition20:00 · Security Affairs · Picked up again

  25. Quiet for 3 days

    Mon 12 OctDay 3891
    1. Ransomware gangs exploit Palo Alto VPN flaw months after patch release09:46 · Infosecurity · Picked up again · Known exploited CVE

  26. Quiet for 8 days

    Tue 20 OctDay 3973
    1. Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-025710:43 · SecurityOnline · Picked up again · Known exploited CVE
    2. Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA16:13 · The Hacker News · Known exploited CVE
    3. Ransomware gangs exploit patched Palo Alto VPN security flaw16:48 · DataBreaches · Known exploited CVE
  27. Wed 21 OctDay 3981
    1. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption12:22 · Infosecurity

  28. Quiet for 9 days

    Fri 30 OctDay 4071
    1. Acronis details Qilin ransomware attacks on ESXi and healthcare07:00 · SecurityOnline · Picked up again

  29. Quiet for 7 days

    Fri 6 NovDay 4141
    1. Leaker names alleged Qilin administrator Haise10:30 · SOCRadar · Picked up again

  30. Quiet for 4 days

    Tue 10 NovDay 4181
    1. Kaspersky says Qilin accounted for 15% of ransomware victims09:00 · Securelist · Picked up again · Known exploited CVE
  31. Wed 11 NovDay 4191
    1. Krebs traces Qilin ransomware boss to Russian cybercrime circles19:00 · Krebs on Security · This article, 39th of 39

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in