Investigative journalist Brian Krebs, along with researchers from Check Point Software and Intel 471, has identified the administrator behind “The Gentlemen” ransomware-as-a-service (RaaS) operation as Alexander Andreevich Yapaev, a 36-year-old Russian national from Izhevsk, Russia. Yapaev operated under the aliases “Zeta88” and “Hastalamuerte” and reportedly also listed a professional role as head of B2B marketing at Uralenergo Udmurtia — a far cry from his actual side hustle.
The Gentlemen have rapidly climbed to become the second most active ransomware gang by victim count since emerging in mid-2025. The group has claimed at least 332 victims, with over 240 in 2026 alone. Their explosive growth is fueled by an aggressive affiliate recruitment model offering a 90% revenue share — far above the typical 70–80% cut offered by competing RaaS operations. The group primarily targets internet-facing devices such as VPNs and firewalls for initial access, often encrypting entire networks within hours.
In a twist of irony, The Gentlemen’s own backend infrastructure was breached in May 2026, exposing internal chats and operational details, including their affiliate payout structure and heavy reliance on FortiGate vulnerabilities for initial access.
Sources
- Krebs on Security — Who Runs The Ransomware Group The Gentlemen?
- SC Media — Ransomware group linked to Russian national
- Dark Reading — The Gentlemen RaaS gang data leak
Commentary
The 90/10 affiliate split is the most interesting detail here. It’s essentially a loss leader strategy for ransomware — Yapaev sacrificed margins to build a massive affiliate network quickly, betting on volume over per-victim revenue. And it worked: 332 victims in roughly a year. The economics of ransomware-as-a-service are becoming increasingly competitive, mirroring legitimate SaaS market dynamics in the worst possible way.
The identification won’t lead to an arrest anytime soon — Yapaev is in Russia, and extradition is a non-starter. But the doxing itself has value: it burns his operational security, deters some affiliates, and creates pressure on any financial infrastructure tied to his real identity. Combined with the backend breach in May that exposed internal communications, The Gentlemen are having a very bad quarter.