Qilin has become the world’s most active ransomware affiliate program, with at least 365 claimed victims in the past three months according to an NCC Group report, and Brian Krebs has dug into who runs it.
- Qilin has been running since September 2022. It offers affiliates at least 80% of every ransom and practices double extortion: steal the data, then encrypt.
- Unlike most Russian programs, it happily works with English-speaking affiliates, and its leader has talked on Telegram about working with Scattered Spider and RansomHub.
- The admin, who goes by “Haise,” changed handles over the years. Krebs, with help from the de-anonymization platform IntelHawk, ties those older accounts and opsec slips back to a man in St. Petersburg.
My take
As always with Krebs, it’s a great read on how careless old accounts catch up with people. For the rest of us, the takeaway doesn’t change: offline, tested backups, MFA on remote access, and patching your edge gear fast. Ransomware crews love an unpatched VPN.
God Bless, and Use the Source!
