OSINT Investigation Links The Gentlemen Admin to Russian Man
Summary
KrebsOnSecurity details an OSINT investigation linking The Gentlemen ransomware administrator aliases Hastalamuerte and Zeta88 to Alexander Andreevich Yapaev in Izhevsk, based on account, phone and email records. Yapaev did not respond.
Key points
- Check Point says The Gentlemen was the second most active ransomware group by victim count, with at least 332 victims claimed since mid-2025.
- The article says the group offers affiliates 90% of ransom payments, compared with an 80/20 split it describes as the industry standard.
- Check Point reports that The Gentlemen targets internet-facing VPNs and firewalls and can encrypt networks within hours.
- Check Point linked administrator aliases Hastalamuerte and Zeta88 to management of the group’s locker, RaaS panel and payments.
- Intel 471, Constella Intelligence and other sources connect forum and messaging accounts, email addresses and a phone number to Alexander Andreevich Yapaev of Izhevsk.
- The identity link is presented as an OSINT-based attribution, not as a confirmed identification; Yapaev did not respond to requests for comment.
Article Details
- Attack Vectors
- Check Point reports that The Gentlemen targets internet-facing VPNs and firewalls as entry points, then can encrypt entire networks within hours.
MITRE ATT&CK
Threat Actors
Alexander Andreevich YapaevOpen-source intelligence and database records cited in the article point to Yapaev as the likely real-world identity of the person behind Hastalamuerte/Zeta88; this identification is not presented as confirmed.hastalamuerteCheck Point identifies this nickname as a former moniker of the person it says administers The Gentlemen ransomware operation.The GentlemenReportedly a ransomware-as-a-service group and the second most active ransomware group by victim count; Check Point says it has claimed at least 332 published victims since its inception in mid-2025.zeta88Check Point identifies this nickname as the current forum name of the person it says administers The Gentlemen ransomware operation; the article reports that Zeta88 was previously known as Hastalamuerte.
Products
GitHubEpieos says that Protonmail address is also linked to a GitHub account under the username SantaMuerte.ProtonmailIntel 471 finds Hastalamuerte registered on Raidforums in 2020 using the email address [email protected] (1488 is a common combination of two numeric symbols associated with white supremacy).TelegramResearchers have also linked its administrator, known as Hastalamuerte and Zeta88, to a likely real-world identity through forum, Telegram, phone number, and email records.