The Gentlemen Ransomware: Inside the Rise of a Cybercrime Powerhouse

Introduction

In the shifting landscape of cybercrime, a new contender has stormed onto the leaderboard with alarming speed. The Gentlemen, a ransomware-as-a-service (RaaS) operation, has quietly climbed to become the second most prolific gang by confirmed victim count—surpassing established names that have operated for years. Their meteoric rise isn't accidental; it's engineered through a recruitment playbook that breaks every convention in the underground economy. By offering affiliates a staggering 90 percent of every ransom collected, they've attracted a caliber of talent that most groups can only dream of. But beneath the tailored suits and coded courtesy lies a trail of digital breadcrumbs that may finally put a name to the face behind the operation.

The Economics of Loyalty: Why 90 Percent Changes Everything

Traditional RaaS models typically split profits 70/30 or 80/20 in favor of the affiliate, with the core developers retaining the remainder for infrastructure, development, and profit. The Gentlemen flipped this script entirely. Their 90/10 split isn't just generous—it's disruptive. For a skilled penetration tester or initial access broker, the math is undeniable: why build your own encryptor, maintain leak sites, and handle negotiations when you can plug into a turnkey operation and keep nearly all the reward?

• Lower barrier to entry: Affiliates need only bring intrusion skills; the encryptor, negotiation panel, and payment infrastructure are handled.
• Reduced operational risk: Core team absorbs the heat of maintaining leak sites and communication channels.
• Faster time-to-ransom: Standardized tooling means less customization per target.

This model creates a self-reinforcing cycle: better affiliates breach higher-value targets, generating larger payouts that attract even better affiliates. The Gentlemen didn't just join the market—they rewrote its incentive structure.

Operational Fingerprints: Encryptor Design and Victimology

Technical analysis of The Gentlemen's encryptor reveals a codebase built for speed and stealth. Written in Rust—a language increasingly favored for its memory safety and cross-platform compilation—the payload avoids common API calls that trigger EDR alerts. It employs intermittent encryption on large files, skipping every other block to maximize speed while rendering data unrecoverable without the key. The group's victimology tells its own story: a heavy concentration in manufacturing, logistics, and professional services across North America and Europe. These sectors share a common trait—downtime costs that far exceed ransom demands, making payment a rational business decision rather than a principled stand.

Notably absent from their leak site: healthcare, education, and critical infrastructure. Whether this reflects ethical boundaries or strategic avoidance of heightened law enforcement scrutiny remains an open question. What's clear is that their target selection aligns with affiliates who possess established access in these verticals—suggesting the recruitment drive successfully onboarded operators with existing footholds.

Following the Digital Breadcrumbs: Clues to the Administrator

Every cybercrime operation leaves traces, and The Gentlemen is no exception. Researchers have identified several vectors that may converge on the administrator's real-world identity:

• Infrastructure overlap: Historical SSL certificates and hosting providers linked to earlier, smaller campaigns share registration details with current command-and-control domains.
• Linguistic analysis: Ransom notes and negotiation logs exhibit consistent idiolect—specific phrasing, punctuation habits, and timezone-aligned response patterns pointing to an operator in Eastern Europe.
• Cryptocurrency tracing: On-chain analysis of ransom wallets reveals a clustering pattern where funds move through a consistent set of mixers and exchanges, with occasional operational security lapses linking to KYC-verified accounts.
• Code reuse: Functions within the encryptor share structural similarities with a defunct RaaS from 2021 whose developer was briefly detained but released—a potential lineage worth investigating.

Individually, none of these threads are conclusive. Together, they form a tapestry that intelligence agencies and private researchers are actively pulling. The administrator's operational security is strong but not perfect—and in this game, perfect is the only standard that survives.

Conclusion

The Gentlemen have proven that in the ransomware economy, incentives trump ideology. Their aggressive revenue share didn't just buy affiliates—it bought momentum, and momentum in cybercrime compounds faster than compound interest. But every empire leaves a paper trail, and the administrator's identity may already be known to the right people in the right agencies. For defenders, the lesson is clear: the threat isn't a shadowy genius in a hoodie; it's a well-structured business with predictable processes, measurable infrastructure, and human operators who make mistakes. Grivyonx Cloud's AI-driven threat intelligence platform continuously tracks RaaS ecosystems like The Gentlemen, correlating infrastructure, cryptocurrency flows, and TTP evolution to give security teams the context they need—before the ransom note arrives.