The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. But even top Russian hackers make operational security mistakes, and the administrator of Qilin has made a few key missteps over the last decade that all point to a 36-year-old man living in St. Petersburg, Russia.

Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June).

Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims. Its members practice the “double extortion” model, stealing sensitive data before encrypting systems and threatening to publish the files online. Unlike most ransomware partnerships based out of Russia, Qilin is happy to team with English-speaking affiliates, and its leader has shared on Telegram that they’ve worked with cybercrime groups like Scattered Spider and RansomHub.

The head of Qilin goes by the handle “Haise,” but they weren’t always known by this nickname. It is not uncommon for cybercriminals to change their handle periodically as an operational security (opsec) measure. Doing so is generally a smart move, because it helps to sever one’s ties to older identities that may not have been as careful on basic opsec, such as separating their real life identity from their cybercrime activities. But even those cautious criminals will sometimes have to reference their past monikers when applying for membership at a new forum. And forums eventually get hacked or seized. That is precisely what happened with Haise.

The cyber intelligence platform Intel 471 records that in June 2022, Haise applied for membership to RAMP, a closely-guarded Russian cybercrime forum that was created as a haven for ransomware affiliate programs. Intel 471 has indexed direct messages from RAMP (the forum was seized by the FBI in January 2026), and those missives show the RAMP administrator approved Haise’s application, referring to this user as Haise and by their Telegram username: Alexbigboss44.

Searching Intel 471 for Alexbigboss44 reveals this was the Telegram account name shared by the user Rjun on the Russian cybercrime forums Exploit and XSS two years earlier in 2020. The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access [full disclosure: Flashpoint is an advertiser on this blog].

Flashpoint says this user was engaged in high-volume acquisition of Facebook logs and Google Ads accounts to facilitate fraudulent advertising and gambling schemes, and that they functioned as a broker and operator — managing a network of traffickers and purchasing compromised data to fuel their operations.

The link between the Qilin administrator Haise and the much older Rjun and Alexbigboss44 accounts was shared privately earlier this month by IntelHawk, which describes itself as an AI-based platform capable of de-anonymizing threat actors based on historical usernames, stylometry and other signals.

IntelHawk founder and chief technology officer Leo Bogod said an analysis of these identities shows a progression from novice arbitrageur and credit card fraudster in 2018–2019 to a more experienced participant and organizer of complex cybercrime-related activities in 2020–2023, with increasing attention to malware, botnets, and payment infrastructure.

Where does this connection between these threat actor identities lead? Intel 471 finds that by the time Alexbigboss44 was applying for membership to RAMP, Rjun was already a longtime member of several other Russian crime forums, including Darkmarket, Verified, and Zloy. Intel 471 says Rjun signed up at all of these sites with the email address mail-30a@mail.ru.

The identity threat protection firm Spycloud found the email address mail-30a@mail.ru at one time used the password “Rjun132” [Spycloud is also an advertiser on this blog]. A search for that email at the breach tracking service Constella Intelligence shows that it appeared in records maintained by gosuslugi.ru, the official digital platform for state and municipal services in the Russian Federation.

Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers. According to the leaked Gosuslugi records (via Constella), the address mail-30a@mail.ru belongs to 36-year-old Aleksey Mikhailovich Yakovtsev from St. Petersburg, Russia.

Flashpoint finds Haise has long used a Telegram account with the user ID 118329521, recording more than 5,000 messages from this user since 2018. Records from Russia’s education watchdog Rosobrnadzor reveal that Mr. Yakovtsev went to grade school in Murmansk and that he holds a master’s degree in computing and information systems.

A search on this Telegram ID in Constella shows it is linked to the Russian phone number +79602347275. Pivoting on that phone number in Constella reveals it is connected to the email addresses aleksey1990yakov@mail.ru and rjun123321@mail.ru. IntelHawk finds that +79602347275 belongs to Yakovtsev’s biological sister, and that Aleksey often used his sister’s email address when registering at different websites.

That phone number appears on several airline flight records at Russian travel agencies that have experienced a data breach in recent years, and those records show Aleksey Yakovtsev, born August 18, 1990, flew between St. Petersburg and Murmansk at least three times between 2013 and 2014.

More recent flight records show that while Mr. Yakovtsev has not traveled by plane outside of Russia, he does fly frequently between Saint Petersburg and Sochi. Often called the “Russian Riviera,” Sochi is Russia’s largest resort city, situated along the coast of the Black Sea and about 1,200 miles south of Saint Petersburg by plane.

Attempts to reach Mr. Yakovtsev via email and phone were unsuccessful.

Further reading: Gang Exposed, an anonymous Twitter/X account that has a history of successfully deanonymizing suspected ransomware actors, reached similar conclusions about Haise’s real-life identity, crediting IntelHawk’s platform for helping to connect the dots.

Federal agencies are drowning in cybersecurity data. Every day, security operations centers absorb millions of logs, scanner alerts and inventory feeds. But raw, static data isn’t actionable intelligence. Ask a room of federal CISOs to name the three critical weaknesses an adversary could exploit today to compromise their missions, and you’ll likely be met with a mountain of compliance reports.

That disconnect reveals a critical velocity problem in government risk management.      Traditional vulnerability management treats every Common Vulnerabilities and Exposures (CVE) entry and high Common Vulnerability Scoring System (CVSS) score as an equal emergency, regardless of whether it’s actually exploitable. Security teams spend weeks chasing theoretical findings, while adversaries exploit overlooked attack paths in hours. CVSS scores are static abstractions: they cannot reveal whether a flaw is reachable today, chainable with other weaknesses or capable of causing immediate mission damage.

As AI collapses the window between vulnerability disclosure and exploit execution, CISA’s issuance of BOD 26-04 marks a long-overdue pivot. The directive codifies what frontline defenders already know: agencies cannot win 90-day patch races against adversaries moving at machine speed. Federal cyber defense must shift from reactive spreadsheet patching to real-time prioritization based on exploitability, active threats and mission risk.

Vulnerable does not mean exploitable

During 30 years in IT operations and military cyber environments, I lost count of how many times I had to tell an auditor: “That high-severity CVE is a false positive, the vulnerable module isn’t running, or we’ve mitigated it six different ways.”

That gap between vulnerable and exploitable is where federal security teams lose the clock. Vulnerability scanners produce thousand-page laundry lists. Teams work from the top down, spending finite engineering hours patching high-severity “purples.” They often exhaust their time and budget before reaching the medium- and low-severity findings.

Adversaries do not follow a 90-day patch cycle. Attackers rarely burn a valuable zero-day exploit when a misconfiguration, weak trust relationship or stolen credential provides a direct path to their objective. As my colleague Todd Beebe from Freeport LNG has noted, “Credentials are the everyday zero-day.” Attackers don’t hack in when they can simply log in.

Defenders spend months building fortresses around static “crown jewel” systems while adversaries maneuver around those controls by chaining low-severity weaknesses with compromised identities. CVEs are only part of the story: misconfigurations and the tactics, techniques and procedures that live between CVEs matter just as much. We’ve validated thousands of attack paths across thousands of organizations that led to critical impact without leveraging a single CVE, and the only way to understand those paths is through offense-driven defense. Closing a vulnerability ticket on schedule doesn’t mean you have stopped an attacker. Untested assumptions are what get organizations in the news.

The cyber version of the McNamara Fallacy

Federal leaders risk falling victim to a modern cyber version of the McNamara Fallacy. Named for Defense Secretary Robert McNamara’s reliance on quantifiable metrics during the Vietnam War, it describes managing by what is easiest to count (e.g., patches applied, tickets closed and average CVSS scores) while overlooking operational reality.

I learned this lesson firsthand while leading IT and cybersecurity operations for a specialized defense unit. Our team was compliant. We checked every DISA STIG box, passed every audit and maintained immaculate documentation. Then a red team assessed our environment. Across people, process and technology, our organization performed well, but the assessment still found things a threat actor could immediately take advantage of.

When I asked whether they could return in three months to verify our fixes, they laughed. “No way,” they said. “You don’t have the budget, and we don’t have the resources.”

That experience fundamentally shifted my mindset: it is much easier to be compliant than secure.

Human-led penetration testing remains valuable, but small-scoped, point-in-time assessments cannot match today’s threat velocity. A manual test conducted annually gives you 24 hours of confidence and 364 days of guesswork. In an AI-accelerated environment, the report may be stale before the ink dries.

Proving defenses work in real time

Across modern framework developments, from NIST SP 800-53 Rev. 5 and NIST CSF 2.0 to federal zero trust mandates, FedRAMP, and Continuous Threat Exposure Management (CTEM), the market is shifting from static attestation toward validation and verification:

• Compliance asks if a control is present and documented.
• Validation asks if that control stops realistic attacker behavior now.
• Verification asks if remediation eliminated the attack path in production.

To outpace adversaries, agencies must augment human expertise with autonomous penetration testing capabilities. We know this works in high-assurance public-sector environments. Under the NSA’s Continuous Autonomous Penetration Testing (CAPT) program, autonomous testing has logged 223,833 hours of operations across 28,282 completed pentests, spanning more than 3.7 million endpoints across 822 Defense Industrial Base organizations.

More importantly, the program accelerated remediation, saving more than 340,000 labor hours and enabling lean security teams to verify and close 71% of critical findings within 30 days. That is the difference between an annual-audit mindset and real-time operational defense.

Three action steps for federal leaders

Federal leaders should take three steps to operate at the speed of the threat:

1.   Define risk through exploitability and impact. Risk is the product of likelihood and impact. But legacy vulnerability management accepts theoretical guessing of likelihood and fails to account for the consequences of the exploitation. Remediation should prioritize validated attack paths posing immediate mission risk.

2. Move to continuous verification. In the military, we said, “Trust but verify.” In modern cyber defense, it is simply “verify.” Agencies must safely and continuously test controls, architectures, and identity permissions in production from multiple perspectives, including outside-in, assumed-breach, identity-based, and cloud-native.
3. Verify the fix, not the activity. A ticket should not close merely because someone deployed a patch or changed a configuration. It should close only after a targeted retest confirms the exploitable attack path is gone.

As Corey Brunkow, Horizon3’s Director of Federal Operations, puts it: “Compliance is the baseline, not the finish line. In the new era of AI-enabled attacks, government and supply chain partners cannot afford to mistake a documented security control for an effective one.” The only way to know whether defenses can withstand an adversary is to send an attacker at them. Federal leaders must turn the map around, view their networks through the eyes of the adversary and continuously validate their security posture before an opponent does.

Learn how Horizon3 can help organizations move from point-in-time compliance to continuous, autonomous penetration testing.

The post Why federal cyber defense demands an offense-driven mindset appeared first on CyberScoop.