The Operators Behind The Gentlemen Ransomware Group

The Gentlemen, a notable ransomware group, has gained recognition as the second most prolific ransomware organization based on the number of victims it has targeted. This group employs a lucrative recruitment strategy that offers affiliates a remarkable 90% share of any ransom collected. Security experts from Check Point Software have been monitoring the group's activities, noting its rapid expansion and the recruitment of skilled hackers from rival operations. As of 2026, The Gentlemen have claimed over 240 victims, with a total of 332 since their inception in mid-2025. Their modus operandi involves targeting devices connected to the internet, such as VPNs and firewalls, to infiltrate networks and encrypt data swiftly. The group's leader, known as Zeta88, previously operated under the alias Hastalamuerte, and is believed to be the mastermind behind the ransomware's infrastructure and payment management. Investigations reveal that Hastalamuerte is a bilingual individual active on various cybercrime forums since 2019, with ties to Izhevsk, Russia. Despite the risks, many cybercriminals, including Hastalamuerte, often make fundamental security mistakes early in their careers, which can lead to their identification.