US Update: Who Runs the Ransomware Group Qilin?

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone.

But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St.

Petersburg, Russia.

Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June).

The Qilin ransomware administrator “Haise” advertising his affiliate program on the cybercrime forum RAMP.

Image: Ke-la.com.

Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims.

Its members practice the “double extortion” model, stealing sensitive data before encrypting systems and threatening to publish the files online.

Continue reading at the original source →