Who Runs the Ransomware Group Qilin?

The Qilin ransomware-as-a-service administrator was identified not through a technical breach but through a trail of operational security (OPSEC) mistakes spanning years — reused usernames, linked online identities, and traceable historical activity from 2018–2019 credit card fraud days. This matters because it demonstrates that even sophisticated threat actors remain vulnerable to investigative techniques when they fail to compartmentalize their digital identities. For defenders, the lesson cuts both ways: understanding how threat actors are tracked helps organizations appreciate the value of threat intelligence, and reinforces that ransomware groups like Qilin — with 365 victims in three months — represent a persistent, evolving, and financially motivated ecosystem. The Ransomware-as-a-Service (RaaS) model, where affiliates keep 80% of extortion payments, lowers the barrier to entry for cybercriminals and dramatically scales the threat landscape organizations must defend against.