[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flkc0RYCUYU097QR0IRzVJA2U-w6iLRbliYDYhieh9Lw":3},{"article":4,"iocs":51,"watch_terms":57,"solutions":58,"lesson":115},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":35},"0eb2c44a-9a9d-48f1-9533-8fec91260a07","Who Runs the Ransomware Group Qilin?","who-runs-the-ransomware-group-qilin-5aca5a","The cybercrime group Qilin has emerged as the world's most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.","NCC Group reports that Qilin, the world's most active ransomware-as-a-service gang since September 2022, has claimed at least 365 victims in three months. Cybersecurity researchers have identified the group's administrator \"Haise\" as a 36-year-old man living in St. Petersburg, Russia, through a chain of operational security missteps linking historical usernames Rjun and Alexbigboss44 to the current identity. The administrator's progression shows evolution from credit card fraud and data trafficking in 2018–2019 to leading a sophisticated double-extortion ransomware operation offering affiliates 80% of extortion payments.","Qilin ransomware leader identified as 36-year-old St. Petersburg resident through OPSEC mistakes.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F11\u002Fwho-runs-the-ransomware-group-qilin\u002F",null,"2026-11-11T18:06:01+00:00","2026-11-11T19:00:07.973044+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Qilin","threat_actor",{"name":21,"type":19},"Haise",{"name":23,"type":19},"Rjun",{"name":25,"type":19},"Scattered Spider",{"name":27,"type":19},"RansomHub",{"name":29,"type":30},"NCC Group","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":12,"name":33,"slug":34},"Ransomware","ransomware",[36,41,46],{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":12,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":12,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,54,56],{"type":45,"value":18,"context":53},"Ransomware-as-a-service affiliate program, world's most active RaaS gang since September 2022",{"type":45,"value":27,"context":55},"Ransomware group that collaborated with Qilin",{"type":45,"value":25,"context":55},[29],{"controls":59,"vendors":114},[60,89],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":50,"name":90,"problem":91,"products":92},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":110,"product_name":111,"url":112,"description":113},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":116,"title":117,"body":118,"framework_refs":119,"framework_notes":125},"qilin-administrator-unmasked-through-operational-security-failures","Qilin Administrator Unmasked Through Operational Security Failures","The Qilin ransomware-as-a-service administrator was identified not through a technical breach but through a trail of operational security (OPSEC) mistakes spanning years — reused usernames, linked online identities, and traceable historical activity from 2018–2019 credit card fraud days. This matters because it demonstrates that even sophisticated threat actors remain vulnerable to investigative techniques when they fail to compartmentalize their digital identities. For defenders, the lesson cuts both ways: understanding how threat actors are tracked helps organizations appreciate the value of threat intelligence, and reinforces that ransomware groups like Qilin — with 365 victims in three months — represent a persistent, evolving, and financially motivated ecosystem. The Ransomware-as-a-Service (RaaS) model, where affiliates keep 80% of extortion payments, lowers the barrier to entry for cybercriminals and dramatically scales the threat landscape organizations must defend against.",[120,121,122,123,124],"MITRE ATT&CK T1591: Gather Victim Org Information","NIST CSF 2.0 ID.RA: Risk Assessment","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives",{"NIS2 Article 21(2)(b)":126,"NIST CSF 2.0 ID.RA: Risk Assessment":127,"CIS Control 17: Incident Response Management":128,"MITRE ATT&CK T1591: Gather Victim Org Information":129,"NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives":130},"NIS2 requires entities to have incident handling capabilities; the scale and speed of Qilin's attacks demand that in-scope organizations maintain mature, rehearsed incident response procedures specifically addressing ransomware and extortion events.","Organizations must continuously assess the risk posed by active ransomware groups like Qilin — including the double-extortion model — to prioritize controls proportionate to the current threat landscape.","With Qilin claiming 365 victims in three months, organizations without a tested ransomware-specific incident response plan — covering both encryption and data leak scenarios — are unprepared to contain and recover from an attack.","Qilin's RaaS operation systematically profiles and targets victim organizations, making it critical for defenders to understand and limit the publicly available information attackers use to select and profile targets.","This control requires organizations to receive, disseminate, and act on threat intelligence about active adversaries — directly applicable given the documented and published TTPs of the Qilin group that defenders should be operationalizing."]