Ransomware is no longer just a cybercrime; it is a mature, highly competitive B2B industry. A recent investigation into “The Gentlemen,” currently the second most active Ransomware-as-a-Service (RaaS) group, reveals fascinating insights into criminal economics, operational security failures, and a critical lesson for data privacy policies worldwide.
1. The Economics of Criminal “Trust”
The group is aggressively recruiting affiliates by offering a 90/10 profit split, drastically undercutting the industry standard of 80/20. While this accelerates their growth, it highlights a massive paradox in the cybercriminal underworld: How can affiliates trust the administrator not to keep 100% of the ransom? In RaaS, “trust” is the ultimate vulnerability, and aggressive margins are often a prelude to an inevitable “exit scam.”
2. The Persona vs. The Reality
The group’s administrator operates under aliases like “Zeta88” and “Hastalamuerte,” heavily borrowing aesthetics from Mexican narco-culture and the “Santa Muerte” movement. However, OSINT (Open Source Intelligence) tells a different story. Through a meticulous pivot chain, researchers traced these aliases back to a single anchor: a phone number. That number led to a leaked Russian government database, unmasking the operator as Alexander Yapaev, a 36-year-old marketing executive from Izhevsk, Russia.
However, cybersecurity history proves the opposite. When a state forces the centralization of sensitive data (CURP, biometrics, phone numbers), it does not eliminate the black market; it creates the ultimate, high-value honeypot. As seen in past massive breaches of Mexican government and telecommunications databases, this centralized data inevitably leaks. Once in criminal hands, it allows threat actors to pivot from a simple phone number to a victim’s full identity, supercharging the very targeted extortion the policy was meant to stop.
The Russian ransomware boss was unmasked because his government collected his data. We must ask ourselves: are we building shields for citizens, or catalogs for criminals?