Qilin ransomware group operator identified in St. Petersburg

NCC Group research has identified the administrator of Qilin, the world's most active ransomware affiliate program, as a 36-year-old based in St. Petersburg. Operating since September 2022, Qilin has claimed at least 365 victim organizations in the past three months. The group attracts affiliates with 80 percent profit sharing and employs double-extortion tactics. The operator made operational security errors over the past decade that led to their identification.