[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOIxBwRWQdeqJQlpa9j9bv9hY9m_DfIS-BwdwSzXz1FI":3},{"article":4,"iocs":54,"watch_terms":61,"solutions":62,"lesson":71},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8fbb4cd7-fe73-4454-8243-063bba7fcd69","Who Runs the Ransomware Group ‘The Gentlemen?’","who-runs-the-ransomware-group-8216-the-gentlemen-8217-a4f430","A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid…","The ransomware group 'The Gentlemen' has rapidly grown to become the second most active ransomware gang, attracting hackers with a generous 90% affiliate revenue split. Security researchers have identified the group's administrator, known as Zeta88 and previously Hastalamuerte, as Alexander Andreevich Yapaev, a Russian national from Izhevsk. Yapaev's digital footprint across multiple cybercrime forums and linked accounts provides strong evidence for this identification.","Ransomware group 'The Gentlemen' administrator identified as Russian national Alexander Andreevich Yapaev.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F06\u002Fwho-runs-the-ransomware-group-the-gentlemen\u002F#more-73768","https:\u002F\u002Fkrebsonsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fthegentlemen.png","2026-06-10T16:23:03+00:00","2026-06-10T17:00:19.007+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"The Gentlemen","threat_actor",{"name":21,"type":19},"Hastalamuerte",{"name":23,"type":19},"Zeta88",{"name":25,"type":19},"Alexander Andreevich Yapaev",{"name":27,"type":28},"Check Point Software","vendor",{"name":30,"type":28},"Intel 471","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":31,"icon":33,"name":34,"slug":35},null,"Ransomware","ransomware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"email","hastalamuerte1488@protonmail.com","Email address used by Hastalamuerte on Raidforums.",{"type":48,"value":18,"context":60},"Name of the ransomware group and its malware.",[27,30],{"controls":63,"vendors":64},[],[65],{"slug":66,"name":67,"logo_path":68,"roles":69},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[70],"reported_by",{"slug":72,"title":73,"body":74,"framework_refs":75,"framework_notes":81},"ransomware-groups-exploit-poor-attribution-awareness-and-incident-response-gaps","Ransomware Groups Exploit Poor Attribution Awareness and Incident Response Gaps","The identification of 'The Gentlemen' ransomware leader demonstrates how cybercriminals often leave extensive digital footprints across forums and platforms, yet continue operating due to inadequate threat intelligence gathering and incident response coordination. The group's rapid growth to become the second most active ransomware operation highlights how attractive affiliate models (90% revenue splits) can quickly scale criminal enterprises. Organizations often lack the threat intelligence capabilities and cross-platform monitoring needed to identify and respond to emerging ransomware groups before they become major threats.",[76,77,78,79,80],"NIST IR-1","NIST IR-4","CIS Control 19","MITRE ATT&CK T1486","ISO 27035",{}]