Seized forum messages tie Qilin ransomware leader to 36-year-old St. Petersburg man

Qilin, a ransomware-as-a-service operation active since September 2022, has claimed at least 365 victim organizations in three months, making it the most active affiliate program tracked by NCC Group. Its administrator, known as Haise, recruited affiliates on the Russian forum RAMP, offering at least 80 percent of any ransom paid and using double extortion: steal data, encrypt systems, then threaten publication. The identifying chain comes from archived direct messages and old forum handles.

Intel 471 indexed private messages from RAMP, a Russian cybercrime forum seized by the FBI in January 2026. In a June 2022 application, the forum administrator approved Haise and referenced the Telegram name Alexbigboss44. That Telegram name had been used by Rjun on Exploit and XSS in 2020. Flashpoint records show Alexbigboss44 traded stolen Facebook logs, Google Ads accounts, corporate access, and traffic, acting as a broker managing traffickers.

The pattern is operational, not merely criminal: changing handles is normal, but old forum applications and seized platforms preserve links that later identities cannot erase. Qilin’s willingness to work with English-speaking affiliates, and its reported collaboration with groups such as Scattered Spider and RansomHub, makes it a connector in the ransomware supply chain. The St. Petersburg identification is not an arrest warrant; it is an intelligence assessment built from metadata, stylometry, and historical aliases, with confidence rising as each old account corroborates the next.

Expect law-enforcement and private intelligence firms to use the alias trail to map affiliates, payment infrastructure, and victim negotiations. A named administrator creates pressure points: seized Telegram handles, forum takedowns, and sanctions or indictments could follow if jurisdiction and evidence align. For victims, the immediate value is defensive: Qilin’s high-volume affiliate model favors fast intrusions and public shaming, so detection should focus on data staging, remote access abuse, and extortion page creation.