YOU GUYS - this investigative chain goes from 'anonymous cybercriminal' to 'company marketing executive' through nothing but digital trail analysis! The Gentlemen ransomware group became one of the most active RaaS operations in 2025 — over 332 victims, with more than half that number occurring in 2026 alone - and Check Point shows how they grew so fast. Their secret weapon was a 90/10 affiliate payout instead of the industry standard 80/20 split, attracting skilled operators away from competing programs to their platform. Once inside through vulnerable internet-facing firewalls or VPNs (they specifically target Fortinet devices), they can encrypt an entire network within hours. The mastermind uses multiple aliases — Hastalamuerte and Zeta88 - across numerous Russian forums like Exploit and Breachforums, registered between 2019 and the present. A trail of small mistakes over those years created his real identity: a 2020 Telegram account at @pntst for hacker training showed him struggling with basic tools back when he was just starting out — that early carelessness laid the foundation for everything else. Later, Epieos linked one email to both an Apple ID and a private GitHub under 'SantaMuerte', which in turn connected to phone number 79127650004 via Telegram ID 30907522. Constelll Intel then matched that phone to real-world records showing it belonged to Alexander Andreeovich Yapaev (also known as Chapaev or using the surname Ivanov) — a 36-year-old from Izhevsk, Russia's capital of Udmurt Republic. His company email [email protected] appeared on LinkedIn for his position as head of B2B marketing at Uralenergo Udmurtia, one of the region's largest electrical product distributors. The latest update is that he even uses AI to write malware and assist with post-exploitation after breaching networks through brute-forced Fortinet SSL-VPN credentials — all while maintaining a professional career as a regional business leader!

Source: https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/