Qilin ransomware claims 365 victims; Krebs reports admin clues

What happened

According to Krebs on Security, the ransomware group Qilin is the most active ransomware affiliate program and claims at least 365 victim organizations in the past three months. Krebs says the clues left by the group’s administrator, who uses the handle “Haise,” point to a 36-year-old man living in St. Petersburg, Russia. This is Krebs’s reporting and the conclusions of the firms it cites. It is not a confirmed attribution, and the victim claims are the group’s own, not verified by the source. Krebs says its attempts to reach the man by email and phone were unsuccessful. The article names him; this advisory does not repeat the name.

Krebs says Qilin has operated since September 2022 and cites a report this month from NCC Group describing it as the currently most industrious ransomware-as-a-service gang. Krebs reports the following:

• Qilin offers affiliates at least 80 percent of any extortion amount paid.
• Its members use “double extortion”: stealing data, then encrypting systems and threatening to publish the files.
• Qilin works with English-speaking affiliates, and its leader has said on Telegram that the group worked with Scattered Spider and RansomHub.

On how the link was made, Krebs reports that Intel 471 indexed direct messages from the cybercrime forum RAMP (seized by the FBI in January 2026). Those messages show Haise’s June 2022 application, referring to a Telegram username, Alexbigboss44. Krebs says that name was shared in 2020 by a user called Rjun on the forums Exploit and XSS. Flashpoint, per Krebs, describes that user as a broker of Facebook logs and Google Ads accounts. IntelHawk, which describes itself as an AI-based de-anonymization platform, privately shared the link between Haise and the older identities. Krebs then describes a chain of email, breached-records and travel-record matches that it says lead to the man in St. Petersburg. Krebs also says an anonymous account called Gang Exposed reached similar conclusions.

Not confirmed: the man has not responded in the source. No law enforcement statement is cited, and there is no independent verification beyond the firms Krebs names. None of the victim claims is confirmed by the victims in the source. The source does not state any entry point, victim list or specific vulnerability used by Qilin affiliates.

Am I affected?

The Krebs article is an investigation into who runs the group. It does not name affected products, versions, CVEs or specific victims, so whether your organization is affected is not confirmed by it. The source does not say how affiliates gain access.

The only official source provided is a CISA joint advisory on RansomHub, a different group. Krebs reports that Qilin’s leader said it worked with RansomHub. The CISA advisory does not mention Qilin in the text provided, so its details should not be read as describing Qilin. CISA says RansomHub affiliates typically gain access through phishing, exploitation of known vulnerabilities and password spraying.

What to do now

1. Install updates for operating systems, software and firmware as soon as they are released, which is the first action listed in the CISA RansomHub advisory.
2. Require phishing-resistant MFA (not SMS text based) for as many services as possible, per the same CISA advisory.
3. Train users to recognize and report phishing attempts, per the same CISA advisory.
4. Read the Mitigations section of the CISA advisory, since Krebs reports Qilin’s leader said it worked with RansomHub, while remembering the advisory is about RansomHub, not Qilin.
5. Treat the identity claims as unverified. Do not take action against any individual based on the Krebs report.

Sources

• Krebs on Security: Who Runs the Ransomware Group Qilin?
• CISA: #StopRansomware: RansomHub Ransomware (AA24-242A)