The Gentlemen Ransomware Admin Doxxed to a 36-Year-Old in Izhevsk

The admin of The Gentlemen ransomware group uses Telegram ID 30907522, registered a Protonmail address with white-supremacist numerology, and lists himself on LinkedIn as head of B2B marketing at a Russian electrotechnical supplier. That’s the kind of operational security that makes a 90/10 affiliate split look like a desperate talent grab.

Check Point’s April research clocked The Gentlemen as the second most active ransomware gang by victim count so far this year, with 332 published victims since mid-2025—240 of those in 2026 alone. The group targets Internet-facing devices (VPNs, firewalls) and encrypts entire networks within hours. The revenue split—90% to affiliates versus the industry-standard 80%—is accelerating recruitment from competing programs.

The Trail from Hastalamuerte to Alexander Yapaev

Intel 471 shows Hastalamuerte registered on Breachforums in January 2025 from an IP in Izhevsk, the capital of Russia’s Udmurt Republic. The same user, under the alias Zeta88, signed up on Breached in August 2022 from another Izhevsk address. The Protonmail address [email protected] links to a GitHub account (SantaMuerte) watching malware tools, and to Telegram username @hastalamuerte18 with unique ID 30907522.

Constella Intelligence tied that Telegram ID to the Russian phone number 79127650004, which appears in hacked government databases assigned to Alexander Andreevich Yapaev, 36, of Izhevsk. The same phone number was used to register on Russian social platform Pikabu under the alias “4apai18” (4 being a Cyrillic shorthand for “ch”). LinkedIn shows Alexander Yapaev as head of B2B marketing at Uralenergo Udmurtia, a major electrotechnical and lighting supplier.

Why Russian Cybercriminals Stay Sloppy

Krebs notes that most Russian cybercriminals don’t set out to be arch criminals—they drift into the scene as their skills grow. The Russian government typically ignores ransomware operators as long as they avoid domestic targets and pay off the right people. Yapaev didn’t respond to requests for comment, but his employer’s domain and his LinkedIn profile are now public artifacts of an investigation that started with a backend infrastructure breach at The Gentlemen.

Expect more researchers to pivot on that phone number and Telegram ID. The 90/10 model might buy affiliates, but it bought the admin a permanent doxxing.

Source: Who Runs the Ransomware Group 'The Gentlemen?'
Domain: krebsonsecurity.com