A cybercrime group generally known as The Gents has emerged because the second most energetic ransomware gang by sufferer depend, quickly attracting a gifted pool of hackers by an aggressive recruitment technique that guarantees associates 90 p.c of any ransom paid by victims. This publish examines clues pointing to an actual life identification for the administrator of The Gents ransomware group.
A graphic created and shared by The Gents ransomware group administrator Hastalamuerte on Breachforums in Might 2026. Credit score: ke-la.com.
Consultants on the safety agency Examine Level Software program have been intently overlaying exploits of The Gents, a so-called “ransomware-as-a-service” (RaaS) providing that pays associates handsomely to assist unfold the group’s malware.
“A 90/10 affiliate income cut up — in comparison with the trade commonplace 80/20 — is accelerating the group’s progress by attracting skilled operators from competing applications,” the researchers wrote in April.
Examine Level discovered The Gents are the second most energetic ransomware group by sufferer depend to date this 12 months, claiming not less than 332 revealed victims because the group’s inception in mid-2025 and greater than 240 in 2026 alone.
In response to Examine Level, the group targets Web-facing gadgets (VPNs, firewalls) as their entry level, and as soon as inside strikes rapidly to encrypt total networks inside hours.
Examine Level says the administrator and first operator of the ransomware group makes use of the nickname Zeta88 on the Russian-language cybercrime boards, and that this particular person was beforehand recognized underneath the moniker Hastalamuerte. Examine Level famous {that a} breach of the group’s backend infrastructure made it clear that Hastalamuerte/Zeta88 is the one who assembles the locker and RaaS panel, manages funds, and is actually the administrator of all the program who receives 10 p.c of all ransoms.
WHO IS HASTALAMUERTE?
The cyber intelligence agency Intel 471 reveals that the person Hastalamuerte is a Russian and English talking one that registered on virtually a dozen cybercrime boards between 2019 and the current day, together with Exploit, Breachforums, Ramp_V2, BHF, Raidforums, and Nulled.
Intel 471 reveals that Hastalamuerte registered on Breachforums in January 2025 from an Web tackle in Izhevsk, the capital metropolis of Russia’s Udmurt Republic. Likewise, the person Zeta88 signed up on the English-language cybercrime discussion board Breached in August 2022 from a special Web tackle in Izhevsk.
Intel 471 finds Hastalamuerte registered on Raidforums in 2020 utilizing the e-mail tackle hastalamuerte1488@protonmail.com (1488 is a standard mixture of two numeric symbols related to white supremacy). A lookup on this tackle on the open supply intelligence service Epieos reveals it’s linked to an account at Apple and to a telephone quantity ending in 04.
Epieos says that Protonmail tackle can also be linked to a GitHub account underneath the username SantaMuerte. That account is marked non-public, however a historical past of this person’s exercise reveals they’re watching and growing a variety of malware instruments and exploits.
In April 2020, Hastalamuerte stated on the crime discussion board Nulled that they may very well be contacted on the Telegram immediate messenger identify @hastalamuerte18, and the menace intelligence firm Flashpoint finds this username is assigned the distinctive Telegram ID quantity 30907522 [full disclosure: Flashpoint is an advertiser on this blog].
The breach monitoring service Constella Intelligence stories that Hastalamuerte’s Telegram ID is linked to a different username — “bu4vs” — and to the Russian telephone quantity 79127650004. Pivoting on this telephone quantity in Constella fetches a number of information from hacked Russian authorities databases displaying it’s assigned to at least one Alexander Andreevich Yapaev, a 36-year-old from Izhevsk.
Constella reveals that telephone quantity was used to create an account on the Russian social media platform Pikabu underneath the identify “4apai18,” and reveals Mr. Yapaev has signed up at a variety of web sites utilizing the frequent surname Ivanov, or else “Chapaev” (the numeral 4 is commonly used as shorthand for a “ch” sound in Russian).
A search in Intel 471 for cybercrime discussion board members with the nickname SantaMuerte finds an account by the identical identify created in 2020 on the Russian hacking discussion board Codeby. Intel 471 reveals this person initially registered on Codeby with the not-so-subtle nickname Alexandr 4apaev.
Constella finds Mr. Yapaev usually used the e-mail tackle bu4vs@mail.ru. In the meantime, Epieos reveals this tackle is linked to a LinkedIn account for Alexander Yapaev, who lists himself as the top of B2B advertising and marketing on the firm Uralenergo Udmurtia, one in every of Russia’s largest suppliers of electrotechnical and lighting merchandise.
Mr. Yapaev didn’t reply to a number of requests for remark.
Almost each time we publish one in every of these Breadcrumbs tales, readers are curious to know why it looks like so many cybercriminals from Russia apparently do little to cover their actual life identities. The reality is that — Russian or not — most didn’t precisely got down to be arch criminals, however as a substitute received drawn into the scene regularly over a number of years as their abilities broadened and sharpened.
One other vital dynamic is that the Russian authorities typically both co-opts or ignores cybercriminal exercise inside its borders as long as the hackers don’t steal from or assault Russian companies and residents. Consequently, profitable cybercriminals in Russia are normally insulated from prosecution and arrest by international legislation enforcement companies offered they sometimes repay the suitable folks and don’t journey overseas. And cybercriminals who intend to strictly adhere to these unwritten guidelines might (not less than initially) be much less involved about overlaying their tracks on-line.
However the easiest rationalization is that cybercriminals of all nationalities are inclined to make a variety of primary operational safety errors early of their careers, when they’re much less savvy and have far much less to lose by their carelessness. A evaluate of Hastalamuerte’s early posts on the crime boards (circa 2019-2020) reveals a comparatively unsophisticated and low-skilled hacker nonetheless making an attempt to study the ropes and earn a constructive fame on these communities.
For instance, in June 2020 Hastalamuerte’s Telegram account joined a multi-month coaching program (@pntst) to learn to use fashionable penetration testing instruments, and their candid posts to this hacker coaching camp present Hastalamuerte struggling to make use of these instruments successfully. A Google-translated report of Hastalmuerte’s posts to @pntst is right here.
Replace, June 11, 10:23 a.m. ET: The menace analysis group PRODAFT has launched an in depth writeup on the historical past and present operations of The Gents. PRODAFT stated its findings match the identical persona with “excessive confidence,” and located the administrator (Zeta88/Hastalamuerte) provides associates with preliminary entry instantly, primarily Fortinet SSL-VPN credentials obtained by brute-force assaults or sourced from the group’s personal leak database. Additionally they found the administrator is utilizing AI to develop and keep the ransomware and related tooling, in addition to to help with post-exploitation exercise.
