Who Runs The Gentlemen Ransomware Group? The Zeta88 Unmasking

The Gentlemen Ransomware Group's OpSec Failure: What a Backend Leak Tells Us About RaaS Admins

You know the drill: a new ransomware group pops up, they hit a few targets, and then the security community starts digging. We track their TTPs, their victimology, their code. But it's rare we get a look inside the operation, especially one as active as The Gentlemen ransomware group. That's why the May 2026 backend database leak was such a surprise. It didn't just expose operational details; it allegedly unmasked the group's administrator, 'Zeta88' (or 'Hastalamuerte'), in a way that should make every other RaaS operator nervous.

On platforms like Reddit, you see a lot of talk about this—r/pwnhub and r/SecOpsDaily have been buzzing. People are dissecting the implications, how this kind of internal breach exposes the vulnerabilities even sophisticated ransomware gangs face. It's a rare glimpse into how these operations run, and it shows that even with all the technical prowess, human operational security (OpSec) is still the weakest link.

How a Hosting Provider Leak Exposed the Alleged Mastermind

The Gentlemen ransomware group emerged around July 2025, quickly becoming a significant player. They run a Ransomware-as-a-Service (RaaS) model, offering a generous 90/10 revenue split to affiliates – that's 90% for the affiliate, 10% for the admin, which is better than the typical 80/20 you see elsewhere. They use a dual-extortion strategy, encrypting files and exfiltrating data, then threatening to publish it on dark web leak sites. By October 2025, they'd published 47 victims, and by June 2026, that number had jumped to over 332, with more than 240 just this year. They're fast, hitting entire networks within hours, often getting in through internet-facing devices like VPNs and firewalls.

The administrator, known as 'Zeta88' on Russian-language cybercrime forums and previously as 'Hastalamuerte,' is responsible for building the locker, managing the RaaS panel, and handling payments. This person also gets that 10% cut of every ransom. The leak, which the administrator himself acknowledged as a "partial" compromise, was blamed on their hosting provider, 4VPS. He claimed the core infrastructure was fine, but the damage was already done.

Here's the chain of events that led to the alleged unmasking:

1. Forum Activity: The individual used the moniker 'Hastalamuerte' across nearly a dozen cybercrime forums between 2019 and 2026, including Exploit, Breachforums, Ramp_V2, BHF, Raidforums, and Nulled. They registered on Breachforums in January 2025 from Izhevsk, Russia. Later, as 'Zeta88,' they signed up at the English-language Breached forum in August 2022, also from Izhevsk.

2. Email Trail: The email address hastalamuerte1488@protonmail.com showed up in forum registrations. This email was linked to an Apple account and a phone number ending in 04.

3. GitHub Connection: That same email was connected to a private GitHub account under the username "SantaMuerte," which was observed watching and developing malware tools and exploits.

4. Telegram Link: On Nulled in April 2020, 'Hastalamuerte' listed @hastalamuerte18 as a Telegram contact. This Telegram username has a unique ID (30907522) and is connected to another username, "bu4vs," and a Russian phone number: 79127650004.

5. Real-World Identity: That phone number, 79127650004, is assigned to a 36-year-old individual named Alexander Andreevich Yapaev, located in Izhevsk, Russia.

6. More Digital Breadcrumbs: Yapaev used that phone number to create a Pikabu account under "4apai18." He also registered on the Russian hacking forum Codeby in 2020 as "SantaMuerte," originally using "Alexandr 4apaev."

7. Professional Life: The email bu4vs@mail.ru (linked to the Telegram account) is connected to a LinkedIn profile for Alexander Yapaev, listing him as the head of B2B marketing at Uralenergo Udmurtia, a Russian supplier of electrotechnical and lighting products.

This isn't just a few scattered data points. This is a thorough digital footprint, meticulously pieced together.

The Practical Impact of a Leaked Identity

The technical capabilities of The Gentlemen ransomware group's locker are solid. It's written in Golang for Windows (64bit) and uses 'vibecoding' for ESXi. It hits Windows, Linux, and VMware/ESXi environments, even optimizing for multiple ESXi instances and vSAN storage. They use XChaCha20 and Curve25519 for encryption, with configurable speeds (--fast, --superfast, --ultrafast). The malware handles persistence via schtasks and registry entries on Windows, and system-level autostart on Linux. It propagates using WMI, PowerShell remoting, and network-shared drives. It can operate with SYSTEM privileges on Windows and escalate to root on Linux.

They also put effort into anti-detection and anti-forensics. The locker disables Windows Defender, adds exclusions, deletes RDP logs, Defender support files, Prefetch files, and PowerShell history. It even removes itself after execution. The kill list targets database engines (SQL, Postgres, MySQL), backup utilities (Veeam), remote access tools (TeamViewer), and virtualization services (vmms).

But none of that technical sophistication matters if your OpSec is sloppy. The practical impact of this leak is significant:

• Law Enforcement Target: Alexander Andreevich Yapaev now has a name, a face, a location, and a job. This gives law enforcement a direct target, moving beyond anonymous forum handles.

• Affiliate Distrust: If the administrator can't protect their own identity, how can affiliates trust the RaaS platform to protect theirs? This kind of breach erodes confidence and could lead to affiliates jumping ship, or at least being more cautious.

• Reputational Damage: For a group that relies on its perceived strength and anonymity, having its alleged leader unmasked is a serious blow. It makes them look vulnerable.

• Intelligence Goldmine: The leaked backend data, even if "partial," provides invaluable intelligence on the group's operations, victimology, internal communications, and affiliate management. This helps defenders understand their adversary better.

Despite this setback, The Gentlemen ransomware group remains active. They're still publishing victims, still running their RaaS. This shows the resilience of these operations, but it also shows their Achilles' heel.

What This Means for Ransomware Operations

This incident makes one thing clear: even the most technically capable ransomware groups are vulnerable to OpSec failures. The digital trails we leave behind – forum registrations, email accounts, Telegram IDs, phone numbers, even LinkedIn profiles – can all be correlated. For all the talk of "bulletproof" infrastructure, a single point of failure in personal OpSec can bring it all down.

For defenders, this is a reminder that human intelligence and meticulous digital forensics are still incredibly powerful. While we focus on blocking malware and patching vulnerabilities, understanding the adversary's operational model and identifying key players can disrupt these groups at a fundamental level.

My take? The Gentlemen ransomware group's leak isn't just a fascinating case study; it's a warning shot. For every RaaS administrator out there, this should be a wake-up call to review their own digital hygiene. You can have the best encryption and the fastest locker, but if you're leaving a trail of breadcrumbs back to your real identity, it's only a matter of time until someone connects the dots. And when they do, your anonymity is gone.