Tracing 'The Gentlemen' RaaS: OPSEC Trail Points to an Izhevsk Operator
A 90/10 affiliate split rocketed the crew to second place by victim count. The administrator's forum breadcrumbs are considerably less disciplined.
Key points
- The Gentlemen RaaS offers affiliates a 90/10 revenue split, above the 80/20 most competing programs offer, and has claimed more than 332 victims since mid-2025.
- A backend breach linked the panel operator and payments handler to a single persona: Zeta88, formerly Hastalamuerte.
- Intel 471 and Flashpoint data place both handles in IP space registered to Izhevsk, capital of Russia's Udmurt Republic.
- Breach-data pivots connect Hastalamuerte's Telegram ID to a Russian mobile number appearing in leaked government records under the name Alexander Andreevich Yapaev, 36, of Izhevsk.
- Yapaev did not respond to requests for comment.
How did The Gentlemen grow so fast?
Check Point Research tracks The Gentlemen as the second most active ransomware group by published victim count, with more than 332 claims since its mid-2025 launch and over 240 posted in 2026 alone. The recruitment pitch is a 90/10 revenue split, well above the 80/20 norm, which Check Point says is pulling experienced operators away from competing programs. Entry points are exposed VPN concentrators and edge firewalls; full-domain encryption follows within hours. The TTPs overlap with several post-LockBit splinters. Treat any cluster mapping as medium confidence until more incident-response telemetry surfaces publicly. Our earlier analysis of the Go-based encryptor, filed 29 May 2026, found that lateral movement, not file-locking, is the primary design goal.
Who is the administrator?
A breach of the group's backend infrastructure, according to Check Point, established that a single person assembles the locker, runs the RaaS panel, manages payments and keeps the administrator's 10 percent cut. That person uses the handle Zeta88 on Russian-language forums and was previously known as Hastalamuerte.
Intel 471 shows Hastalamuerte registered on Exploit, Breachforums, Ramp_V2, BHF and Nulled, among others, with sign-ups dating to 2019. Hastalamuerte registered on Breachforums in January 2025 from an IP address in Izhevsk. Zeta88 registered on the Breached forum in August 2022 from a separate Izhevsk address.
The early OPSEC was rough. Hastalamuerte registered on Raidforums in 2020 using hastalamuerte1488@protonmail.com, the 1488 suffix being a numeric pairing associated with white supremacist signalling. Open-source enrichment via Epieos links that address to an Apple account, a phone number ending in 04, and a private GitHub under SantaMuerte whose activity history tracks malware and exploit repositories.
Does the trail reach a real name?
In April 2020, Hastalamuerte posted on Nulled that they could be reached at Telegram handle @hastalamuerte18. Flashpoint (a disclosed advertiser on KrebsOnSecurity, where this attribution work first appeared) assigns that handle the Telegram ID 30907522. Constella Intelligence links that ID to a second handle, bu4vs, and to the Russian mobile number 79127650004. That number appears in leaked Russian government records under the name Alexander Andreevich Yapaev, 36, of Izhevsk.
The same number created a Pikabu account as 4apai18. On the Russian hacking forum Codeby, a SantaMuerte account from 2020 originally registered under the handle Alexandr 4apaev. The address bu4vs@mail.ru, connected to Yapaev, resolves via Epieos to a LinkedIn profile listing Alexander Yapaev as head of B2B marketing at Uralenergo Udmurtia, an electrotechnical supplier.
The chain is long. Each pivot rests on a different data source, which reduces the risk of a single poisoned record pulling the whole thread wrong, but the final identification still carries medium confidence given the reliance on breach data from third parties.
Should you worry?
Russian-based operators have long benefited from a tacit non-prosecution arrangement: avoid domestic targets, stay off foreign soil. That insulation tends to produce sloppy early-career OPSEC that never gets corrected. Hastalamuerte's posts to the paid pentest training channel @pntst in June 2020 show an operator who couldn't reliably run basic recon tooling at the time.
Six years on, that same operator allegedly runs the second-busiest ransomware brand on the board. Capability and trajectory aren't the same thing, and that gap is the real story here.
