Investigators allege the 28-year-old built attack infrastructure for Qilin and received a percentage of ransom payments collected by affiliate teams.