The Gentlemen RaaS Affiliate Steals Victim Funds, Runs Parallel Leak Site

An affiliate associated with the The Gentlemen ransomware-as-a-service (RaaS) group has been identified as stealing funds from victims while simultaneously operating a parallel data leak site. According to a report by Infosecurity Magazine, this affiliate deviated from the standard operational procedures of the RaaS group to conduct unauthorized extortion activities against two dozen victims.

The affiliate’s actions represent a significant breach of the implicit contract between RaaS operators and their affiliates. Typically, affiliates pay a percentage of ransom proceeds to the operator in exchange for the malware and infrastructure support. In this instance, the affiliate bypassed the operator’s control mechanisms to extort victims directly and retain the stolen funds. The parallel leak site served as a tool to pressure victims into paying these unauthorized ransoms, creating a chaotic environment for the targeted organizations.

Context and Background

The Gentlemen ransomware group has established itself as a notable player in the cybercrime landscape, utilizing the RaaS model to expand its reach. This model allows less technically sophisticated criminals to conduct attacks using tools provided by a central operator. However, the trust required for this partnership is fragile. The recent incident highlights the inherent risks within the RaaS ecosystem, where affiliates may prioritize immediate financial gain over long-term cooperation with the operator.

According to Infosecurity Magazine, the affiliate ran the parallel leak site during the active extortion of the two dozen victims. This suggests that the affiliate was actively managing the threat of data exposure to coerce payments. The existence of a secondary, unauthorized leak site complicates the response for victims, who may face conflicting demands or confusion regarding which group holds their data. The operator of The Gentlemen RaaS likely lost revenue from these specific attacks, as the affiliate kept the proceeds.

Who Is Affected

The immediate victims of this scheme are the approximately two dozen organizations targeted by the rogue affiliate. These entities faced the dual threat of ransomware encryption and data theft, with the added complication of dealing with an affiliate who was not acting in accordance with the main group’s protocols. The impact on these victims includes potential data loss, operational disruption, and financial loss due to ransom payments made to the rogue affiliate.

Furthermore, the integrity of The Gentlemen RaaS group is affected. While the operator is not directly responsible for the affiliate’s theft, the incident reflects poorly on the group’s ability to control its network. Other affiliates may view this as an opportunity to act independently, potentially leading to a fragmentation of the group. Victims of The Gentlemen in the past may also need to reassess the security of their data, as the rogue affiliate’s actions demonstrate that internal disputes within criminal groups can lead to unpredictable outcomes.

What should you do?

Organizations that have been targeted by The Gentlemen ransomware or similar RaaS groups should review their incident response logs for any signs of unauthorized communication channels. The presence of multiple leak sites or conflicting demands may indicate that an affiliate is acting independently. Security teams should monitor threat intelligence feeds for updates on rogue affiliates and parallel operations.

What to do and how to stay safe: The Gentlemen

• Monitor threat intelligence sources for reports on rogue affiliates or parallel leak sites associated with known RaaS groups.
• Verify the identity of extortionists by cross-referencing domain names and contact details with official group indicators.
• Ensure that backup systems are isolated and regularly tested to mitigate the impact of ransomware encryption.
• Review access logs for any unusual activity that may indicate an affiliate is operating outside the standard RaaS framework.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is responsible for the stolen funds in this incident?

The affiliate of The Gentlemen RaaS group is responsible for stealing the funds from the victims, bypassing the main operator.

How many victims were affected by this rogue affiliate?

The rogue affiliate targeted approximately two dozen victims during the period of unauthorized operation.

Did the main operator of The Gentlemen RaaS know about this?

The source material does not specify whether the main operator was aware of the affiliate’s actions before they were reported.