Security researchers have traced digital breadcrumbs linking The Gentlemen ransomware operation to a 36-year-old Russian marketing executive who made basic operational security mistakes early in his cybercrime career.
Summary
- The Gentlemen ransomware group has become the second most active by victim count, claiming 332 victims since mid-2025
- The group offers affiliates a 90/10 revenue split, well above the industry standard 80/20, accelerating recruitment
- Researchers linked the group’s administrator to Alexander Yapaev, a marketing executive at a major Russian electrical supplier
- The identification was possible due to years of poor operational security practices and reused usernames across platforms
- The group targets internet-facing devices as entry points and can encrypt entire networks within hours
Rapid Growth Through Generous Affiliate Terms
The Gentlemen ransomware operation has surged to become the second most active ransomware group by victim count this year. Check Point Software researchers report the group has claimed at least 332 published victims since launching in mid-2025, with more than 240 victims in 2026 alone. The group’s aggressive recruitment strategy centres on offering affiliates 90 percent of ransom payments, significantly higher than the typical 80/20 split used by competing ransomware-as-a-service operations.
Attack Methods and Infrastructure
Check Point’s analysis reveals The Gentlemen typically gain initial access through internet-facing devices including VPNs and firewalls. Once inside target networks, the group moves quickly to deploy encryption across entire infrastructures within hours. The operation follows a ransomware-as-a-service model, with a central administrator managing the malware, payment systems, and affiliate recruitment while taking a 10 percent cut of all ransoms.
Digital Trail Leads to Russian Executive
Security researchers have traced the group’s administrator through a series of operational security failures spanning several years. The individual uses the handles Hastalamuerte and Zeta88 across various cybercrime forums. Intelligence firm Intel 471 tracked registration data showing both accounts originated from IP addresses in Izhevsk, the capital of Russia’s Udmurt Republic.
Years of Poor Operational Security
The investigation uncovered a pattern of reused usernames, email addresses, and personal information across multiple platforms. The email address hastalamuerte1488@protonmail.com was linked to Apple accounts, GitHub profiles, and Telegram handles. Threat intelligence firm Constella Intelligence connected these digital breadcrumbs to the Russian phone number 79127650004, which appears in hacked Russian government databases registered to Alexander Andreevich Yapaev, a 36-year-old marketing executive.
From Amateur to Administrator
Records from cybercrime forums show the individual’s progression from an unsophisticated beginner to a major ransomware operator. Early posts from 2019-2020 reveal someone still learning basic penetration testing tools through training programs. In June 2020, the Hastalamuerte account joined a multi-month course to learn popular hacking tools, with posts showing difficulty using these capabilities effectively.
The Russian Cybercrime Dynamic
The apparent lack of concern about operational security reflects broader dynamics within Russian cybercrime. Researchers note that many cybercriminals did not initially intend to become major criminal operators but were gradually drawn into increasingly serious activities. Russian authorities generally tolerate cybercriminal activity provided it targets foreign entities rather than domestic Russian businesses or citizens, creating an environment where successful operators face little risk of prosecution if they avoid international travel.
Why it matters
This case demonstrates how even sophisticated ransomware operations can be traced through historical operational security failures, while highlighting the growing threat from groups using aggressive affiliate recruitment strategies. For CISOs, it underscores the importance of securing internet-facing infrastructure and preparing for rapid encryption scenarios where attackers can compromise entire networks within hours.
What to do now
- Review and harden security controls for internet-facing devices including VPNs and firewalls
- Implement network segmentation to limit lateral movement if perimeter defences are breached
- Prepare incident response procedures for rapid encryption scenarios with sub-hour deployment timelines
