- The Gentlemen ransomware group is the second most active by victim count, offering affiliates a 90/10 revenue split (vs. industry 80/20) to attract talent.
- The group targets Internet-facing devices like VPNs and firewalls, encrypting networks within hours of entry.
- Researchers identified the administrator as Alexander Andreevich Yapaev, using nicknames Zeta88 and Hastalamuerte, operating from Izhevsk, Russia.
- The identification was achieved through OSINT techniques linking forum posts, emails, phone numbers, and social media accounts.
- Russian cybercriminals often have weak opsec due to government tolerance of foreign attacks and early career mistakes, and the group uses AI for ransomware development.