Russian Man Linked to Infamous Qilin Ransomware Group After Investigation Traces Online Identities

A recent report from security analysts links the mastermind of the ransomware group known as Qilin to a 36-year-old from Saint Petersburg, Russia. Qilin is now one of the most active ransomware groups in the world.

The suspect behind the attacks goes by the name Haise. Investigators believe him to be Aleksey Mikhailovich Yakovtsev, who resides in Saint Petersburg.

How Researchers Found the Link

Security firm KrebsOnSecurity released the investigation details on November 11. The team collaborated with various cyber intelligence agencies such as Intel 471, Flashpoint, IntelHawk and SpyCloud.

Researchers traced Haise by searching for his previous online identity. Further, they found out about his other usernames, ‘Rjun’ and ‘Alexbigboss44,’ that were active on Russian cybercrime forums.

In addition to earlier usernames, the researchers had access to older phone numbers, email accounts, and travel records. These details later helped them to connect online identities with Yakovtsev.

One of the pieces of information that played a significant role in this investigation was a leaked email address. The investigators found this information in the records of the service portal of Russia called Gosuslugi. This email address has been connected to Yakovtsev and researchers found out that he took flights between St. Petersburg and Murmansk.

KrebsOnSecurity reported that they tried to contact Yakovtsev via email and phone, but got no reply. The findings are no proof that police have not arrested or charged him. They just established a significant research-based link between the online identity & the St Petersburg resident.

How Qilin Makes Money

Qilin is functioning as a ransomware-as-a-service organization. This indicates that its leaders give tools and guidance, while various other criminals perform attacks.

These criminals operate as affiliates. They penetrate businesses, steal confidential information, and deploy malware to encrypt files. Qilin has also used unconventional methods to avoid detection during its attacks. In one reported campaign, the group used MS Paint and Notepad for stealthy data theft, demonstrating how ransomware operators can misuse legitimate Windows applications during their operations. Qilin also operates with a technique called double extortion.

First, the group collects sensitive information. Then, it encrypts the systems & demands payment to lock them The criminals may threaten their victims of publishing the information they’ve obtained from their systems. This move puts pressure on most victims to pay.

The group offers affiliates around 80 percent of the ransom that they retrieved from victims. Such a huge share serves as an attractive steak on skilled attackers. The group has operated since September 2022. It now ranks as the most active ransomware affiliate program worldwide, according to NCC Group.

The Rapid Growth of Qilin

The Qilin group attacked over 365 victims, in just three months. It is one of the busiest ransomware groups in the globe. The group has targets in various sectors. Most victims are companies that concentrate in industries like healthcare, financial services, & technology.

Qilin has also collaborated with criminals who speak English. This is something that many Russian-speaking groups do not do. The group has also reportedly partnered with other ransomware groups such as RansomHub and Scattered Spider.

This was revealed by the leader of the group in a post on Telegram, a famous app among cybercriminal organizations as strong firewall protection makes it possible to avoid interception.

The success of Qilin shows that ransomware is becoming more and more popular because criminals have started understanding that it is a business now. Leaders provide tools, while affiliates carry out attacks and share the profits.

What this Means for Businesses

The investigation revealed that even criminals have their footprints. This means that recycled passwords, usernames & leaked data can help identify guilty individuals. A business should regard ransomware as a significant threat. It must create robust passwords, often update programs, and maintain good backups.

Moreover, companies should train workers on how they should be able to detect phishing emails plus malicious links. Many successful ransomware attacks are the result of a minor misstep by a worker. Backup is essential for businesses in case they want to retrieve their data without paying a ransom. At the same time, it is important that companies do not connect backups to the net. 

The case demonstrates the necessity of strong data protection by organizations. This is because criminals can use stolen information against a company even after they mitigate the cyberattack.