Who Runs the Ransomware Group Qilin?

Runs was hit by a ransomware attack from Qilin that didn't stop at encryption -- data was copied out too.

The group has claimed 471 records were affected, though that figure comes from the attackers' own claim and is not independently verified.

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone.

Runs is now dealing with both a system outage and stolen data sitting outside its control.

Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June).

But even those cautious criminals will sometimes have to reference their past monikers when applying for membership at a new forum.

Anyone whose data Runs holds is potentially affected, not just Runs itself.

Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims.

Its members practice the double extortion model, stealing sensitive data before encrypting systems and threatening to publish the files online.

The threat didn't stop at locking files; stolen data sitting on a leak site is a second, separate form of pressure that a restored backup can't fix.

The cyber intelligence platform Flashpoint finds Alexbigboss44 is a prolific participant in cybercriminal forums and Telegram channels, primarily focused on the illicit trade of traffic, logs, and corporate access [full disclosure: Flashpoint is an advertiser on this blog].

Gosuslugi was breached in late 2025, reportedly exposing more than 20 million records with full names, birth dates, and mobile numbers.

The attack has been attributed to Qilin, a named ransomware operation.

The Qilin ransomware administrator Haise advertising his affiliate program on the cybercrime forum RAMP.

Unlike most ransomware partnerships based out of Russia, Qilin is happy to team with English-speaking affiliates, and its leader has shared on Telegram that they’ve worked with cybercrime groups like Scattered Spider and RansomHub.

Review backup integrity and restoration speed now, before an incident, since recovery speed is what separates a bad week from a bad year.

Your own incident-response and business-continuity plan is only as good as the longest outage it was actually built for, not just a short disruption.

Intel 471 finds that by the time Alexbigboss44 was applying for membership to RAMP, Rjun was already a longtime member of several other Russian crime forums, including Darkmarket, Verified, and Zloy.