Threat Intelligence

Anonymous Leaker Claims to Unmask Qilin Ransomware Admin 'Haise', but Nothing Is Confirmed

SOCRadar · 6 Nov 2026

Key Takeaway Treat unverified attributions of ransomware operators with caution, and focus your effort on proven defences such as tested offline backups, multi-factor authentication and a practised incident response plan.

GangExposed, an anonymous leaker who spent 2025 exposing Conti and Trickbot leadership, has turned to the Qilin ransomware group. A new post names a Russian national as "Haise", the persona that has fronted Qilin's affiliate program on underground forums since 2022. No authority has confirmed the identification. Germany recently arrested a Russian national suspected of being a leading Qilin member, following extradition from Japan, but nothing public links that suspect to Haise.

The Haise persona itself is well documented. The profile joined the Russian-language RAMP forum on 29 May 2022 and was openly advertising Qilin's affiliate program by 13 February 2023. In March 2023, researchers who infiltrated Qilin learned that affiliates kept 80% of ransom payments up to $3 million and 85% above that. In June 2025, a "call lawyer" feature was pitched to affiliates as legal support for pressuring victims during negotiations. A Telegram channel impersonating Europol later offered rewards for Haise and another administrator persona, "XORacle", and Europol called it a scam.

GangExposed's write-up relies on forum records, Telegram history and leaked Russian databases, and claims "a high degree of confidence". Its reasoning starts with RAMP approval logs from June 2022 and matches the persona to profiles on Exploit and XSS. SOCRadar notes this is a single investigator's work and should be read carefully before the name is treated as settled. The personal data has not been reproduced here.

Qilin ransomware threat intelligence dark web

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.