Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsA CloudSEK report, as summarized in reporting attributed to Infosecurity Magazine, alleges that an affiliate of The Gentlemen ransomware-as-a-service (RaaS) group ran a parallel leak site while extorting more than two dozen victims, apparently keeping proceeds that would otherwise go to its RaaS partners. The accessible accounts do not establish how the alleged diversion worked, identify the affiliate, or independently verify the victim count.
What is alleged to have happened?
Security Intel Hub’s October 6, 2026 summary of an Infosecurity Magazine article says an affiliate of The Gentlemen operated a parallel leak site while extorting two dozen victims. An Infosecurity Magazine listing on Muck Rack attributes a related account to journalist Phil Muncaster and says CloudSEK reported that a Russian-speaking cybercriminal betrayed RaaS partners to make off with funds extorted from over two dozen global victims. The listing names CloudSEK’s report as The Gentlemen Files, dated October 5, 2026. Security Intel Hub’s summary and Muck Rack’s listing are secondary accounts, not direct access to the underlying report.
As an Amazon Associate I earn from qualifying purchases.
The descriptions differ slightly—“two dozen” versus “over two dozen”—so the precise count is not established. The original Infosecurity Magazine article and CloudSEK report were not available for direct inspection. The reporting therefore supports an allegation, not independently verified details about the leak site, payment path, affiliate’s identity, or individual victims.
How could an affiliate double-cross a RaaS operator?
RaaS separates roles. In general, developers or operators provide ransomware and supporting infrastructure, while affiliates use those tools to attack victims. The parties may share ransom proceeds, but the exact arrangement depends on the group. In the alleged Gentlemen incident, the reported parallel leak site suggests a conflict over control of the extortion operation and its proceeds; available accounts do not explain the mechanics well enough to say precisely how funds were redirected or retained.
A separate example shows why group-specific terms matter: in a 2024 LockBit case, the U.S. Department of Justice alleged that developer Dimitry Khoroshev typically received 20% of each ransom and the responsible affiliate received 80%. Those figures concern the DOJ’s allegations about LockBit, not The Gentlemen, and should not be used to infer this affiliate’s share. The Justice Department’s LockBit announcement also described alleged evidence of operator-affiliate distrust, but it does not corroborate the current allegation.
What does this incident establish—and what does it not?
- Reported: CloudSEK’s findings were summarized as alleging that a The Gentlemen affiliate used a parallel leak site while extorting more than two dozen victims.
- Not established in the accessible accounts: the affiliate’s identity, the precise flow of payments, how the parallel site functioned, a verified victim list, or the independently confirmed number of victims.
- Not transferable: LockBit’s alleged 20/80 split and details of other ransomware groups’ operations do not establish The Gentlemen’s business terms or tactics.
Other groups provide context, not proof. A March 2026 joint advisory from the Australian Cyber Security Centre, CERT Tonga, and New Zealand’s NCSC describes INC Ransom affiliates stealing sensitive data, encrypting files, and threatening publication to pressure victims. That is a different operation; its account of double extortion cannot fill gaps in what is known about The Gentlemen. Read the INC Ransom advisory for that group’s model and mitigations.
Rank #2
What should organizations take from the allegation?
The narrow lesson is that ransomware operations involve multiple actors whose interests and control may not align. A victim-facing leak threat can be part of extortion, but an affiliate’s alleged dispute with an operator does not make the threat harmless or establish what happened to any particular victim’s data. Organizations should rely on incident-specific evidence and established response processes rather than assumptions about who controls a leak site or receives a payment.
The Justice Department’s 2024 LockBit announcement encouraged victims to report attacks to the FBI, noting that reporting can help prevent further attacks. That statement was made by Deputy Attorney General Lisa Monaco in the LockBit case; it is general reporting guidance, not a finding about this incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
