Who Runs the Ransomware Group Qilin?

The Qilin cybercrime group has become the most active ransomware affiliate program globally, with at least 365 victim organizations in the past three months. Despite its success, the group's administrator has made operational security mistakes over the years. These mistakes have revealed clues about the administrator's identity, suggesting it is a 36-year-old man from St. Petersburg, Russia. This individual appears to have been involved in the group's activities for approximately the last decade. The errors made by the administrator have allowed researchers to gather information about their potential identity. The man's connection to the group is based on a series of key missteps that have compromised his operational security.