0.0
For 30 years, we have been guessing what
2.62
the inside of a ransomware operation looks like.
5.92
We could see the outside, the ransom notes,
8.839
the leak sites, the wreckage in hospitals and
12.06
factories and school districts.
13.82
From that, we built a picture, informed, careful,
18.059
and still fundamentally a reconstruction, an outline drawn
21.879
around a hole.
23.339
In May of 2026, the hole filled in.
26.62
One of the most active ransomware operations on
30.179
earth got breached, not raided by police, breached
33.859
by somebody else through a weakness in their
36.34
own supplier.
37.34
Their back office spilled open, the chat logs,
40.579
the staff roster, the ransom negotiation transcripts, the
44.359
discussions about which tools to buy.
46.799
For a short window, before it was pulled
49.06
down, you could read a ransomware company from
51.7
the inside.
52.96
This is Fragment 0, Case File 53.
56.619
The Playbook
59.06
First, who they are, because the name is
62.119
part of the joke.
63.159
They call themselves the Gentlemen.
65.939
They appeared around the middle of 2025 and
69.599
scaled with unsettling speed.
72.079
By 2026, they were among the most active
75.4
ransomware, as a service operations running anywhere.
78.959
In the first five months of that year
81.219
alone, Chet Point Research counted roughly 332 victims
85.48
published to their list.
86.62
Divided into three groups, they described themselves as
86.7
Union of the syllable en wenig fans of
86.7
the league site.
87.18
Three-thirty-two organizations.
89.78
Five months.
91.12
One brand.
92.64
And that phrase, ransomware as a service, is
96.379
the things most people still get wrong about
98.54
this industry.
99.459
So let us be exact about it.
101.84
The Gentleman do not personally break into 300
105.0
organizations.
106.239
That is not The Model.
107.939
The Model is a franchise.
110.62
The core group builds and maintains the product.
113.959
The encryption software.
115.599
The league site.
116.62
the payment infrastructure, the victim management system.
120.32
Then they recruit affiliates, independent operators who do
124.019
the actual breaking in.
125.56
The affiliate gets the tools and the brand.
129.12
The core takes a cut of every ransom.
132.48
It is McDonald's.
133.84
The center owns the recipe and the sign.
136.659
The franchisees run the restaurants.
139.46
Which means a ransomware operation has all the
143.02
things a business has.
145.24
Staff.
146.58
Suppliers.
147.599
Onboarding.
148.599
Support tickets.
149.86
Internal politics.
151.68
A management layer whose actual job is keeping
154.62
the franchisees productive and loyal.
157.479
We have long believed that.
159.199
Now there are documents.
162.68
Here is how they fell, and it is
165.4
close to poetry.
166.5
They rented their infrastructure.
168.68
Like nearly every business, they did not own
171.74
the machines their operation ran on.
173.8
They used a hosting provider.
175.96
The provider was called 4VPS.
178.84
The provider got breached.
181.02
And when it did, everything the gentlemen had
183.74
built on top of it came out with
185.4
it.
185.659
An internal back-end database that their own
188.08
people referred to as Rocket.
190.5
The organization that industrialized attacking companies due their
194.659
weakest supplier was taken apart due its weakest
197.86
supplier.
199.04
On the 4th of May, 2026, their administrator
202.819
went on to the underground forums where these
205.819
underground forums were located.
205.939
The operator's team was told to check the
207.3
images the company used.
207.3
It was
215.5
It was
215.879
It was
216.099
It was
216.68
They confirmed it themselves, in public, to their
219.719
own criminal marketplace.
221.08
Because they had to.
222.78
Their affiliates would find out anyway, and an
225.319
operation that looks compromised cannot recruit.
228.659
Checkpoint Research pulled down a portion of the
231.28
data before it disappeared.
232.879
That window is the only reason any of
235.58
this is legal.
235.919
known so what was inside internal chat logs
241.24
an organizational roster who works
244.0
there and in what role ransom negotiation transcripts
247.539
the actual
248.159
conversations between the gang and the companies they
250.659
had crippled discussions
251.819
about tooling affiliate activity records the victim management
255.68
system itself that
257.72
last one deserves a moment a victim management
261.0
system software whose purpose
263.86
is to keep track of which organizations you
266.439
are currently extorting at what
268.36
stage for how much the same category of
271.74
tool as any sales pipeline pointed at
274.399
hospitals checkpoints assessment of the chats was blunt
277.699
they read like an
279.06
intrusion playbook not theory operators talking shop which
283.72
credentials to abuse
284.8
which enterprise systems they had access to Fortinet
288.54
appliances the security
290.12
hardware that sits at a company's perimeter turned
292.92
into the entrance
293.74
you're not going to be able to access
293.839
it if you don't have access to the
294.66
system which is in fact the only company
295.36
that has access to this system
296.12
the ntlm relay technique a decades-old weakness
300.3
in Windows authentication that
302.06
still works because networks are old and nobody
304.72
wants to touch them and a
306.86
category of software with an unusually honest name
310.199
EDR killers tools built for
313.1
one purpose disabling the endpoint detection software that
316.86
a company
317.24
installs specifically to catch this think about what
320.92
that implies there is a
322.6
supply chain for different types of software such
323.819
as the ntlm relay technique
323.819
feeding security products.
325.319
Somebody builds those tools.
327.399
Somebody sells them.
328.959
Somebody in that chat
330.339
was comparing options the way you would compare
332.66
vendors.
334.959
It would be easy to enjoy this.
337.16
The gang
338.0
that terrorized hundreds of organizations, hoisted by the
341.639
same failure they specialize in.
343.48
There is
344.0
a satisfaction to it, and it is not
345.92
entirely misplaced.
347.54
But look at what the leak actually
349.439
establishes, because it is not comfortable.
353.3
It establishes that this is durable, not a
356.74
crew,
357.199
an institution, with a roster and a supplier
360.1
network and internal process documents.
363.72
Individuals
364.36
in it can be arrested and the structure
366.24
survives, because the structure is the product.
369.18
The
369.819
affiliates are contractors.
371.42
They can work for the gentleman this month
373.639
and a different brand next
375.18
month, carrying the same skills and the same
377.879
tools.
379.439
That is why takedowns have produced the result
382.079
they have.
382.98
Law enforcement has repeatedly destroyed
385.42
ransomware infrastructure, and what follows is not silence,
389.579
but fragmentation.
390.72
The brand dies.
392.459
The people do not.
393.899
They reappear under new names, smaller and more
397.3
numerous and harder to track.
399.18
You cannot arrest a business model.
403.52
The gentleman's back end is gone from the
406.1
internet now.
406.86
The leak was pulled.
408.259
What survived,
409.439
is the analysis, and a set of documents
411.879
that changed a reconstruction into a record.
414.899
Here is what that record says, stripped of
417.959
everything else.
419.439
The people encrypting hospitals are not exceptional.
422.68
They are employees.
424.279
They have a
425.1
manager, a toolset, a revenue split, and a
428.06
support channel.
428.92
They rent their servers from a company
431.1
with a normal website and a normal billing
433.16
page.
433.72
They complain in chat.
435.339
They compare products.
436.879
The threat is not that they are brilliant.
439.96
The threat is that they are organized, and
443.04
that being organized turned out to be enough.
446.519
Fragment 0.
447.779
Case File 53.
449.759
Closed.
450.439
The roster survives the brand.
