Who Runs the Ransomware Group ‘The Gentlemen?’
Summary: Check Point Software reports that a ransomware-as-a-service group called The Gentlemen has become the second most active gang by victim count, claiming at least 332 published victims since its mid-2025 inception and more than 240 in 2026 alone, aided by a 90/10 affiliate revenue split against the industry-standard 80/20. Check Point and Intel 471 trace the group's administrator, who uses the nicknames Zeta88 and Hastalamuerte, to forum registrations from Internet addresses in Izhevsk, Russia, and to a Protonmail address linked to a phone number that Constella Intelligence ties to a 36-year-old Izhevsk resident named Alexander Andreevich Yapaev.
What's compelling: The group enters through Internet-facing VPNs and firewalls and encrypts entire networks within hours, and PRODAFT reports the administrator supplies affiliates with Fortinet SSL-VPN credentials obtained by brute force or pulled from the group's own leak database - so the credential hygiene of an edge device is the difference between a quiet Tuesday and a network-wide encryption event.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026