Who Controls the Ransomware Gang 'The Gentlemen'? An Economic Crime Analysis

July 5, 2026 4 min read

The ransomware underworld operates like any other business, complete with affiliates, revenue-sharing models, and customer support desks. For investors and corporate security teams, understanding the structure of groups like The Gentlemen has become essential reading as cyber extortion costs continue climbing past billion-dollar thresholds annually.

The Gentlemen: Structure of a Criminal Enterprise

The Gentlemen ransomware operation emerged as a Ransomware-as-a-Service (RaaS) model, where core developers maintain the malware while recruiting affiliates to conduct attacks. These affiliates—often based in multiple countries—receive a percentage of each successful ransom payment, typically ranging from 60% to 70% of the total take. The developers retain the remainder in exchange for providing the encryption tools, infrastructure, and negotiation support.

This distributed structure creates significant challenges for law enforcement. No single leader controls everything. Instead, The Gentlemen functions as a network of independent operators united by shared tooling and a common brand. Researchers studying the group have noted its professional approach to victim communications, including negotiating timelines and even offering discounts for prompt payment.

Double-Extortion: The Business Model That Changed Everything

Modern ransomware groups, The Gentlemen included, employ a strategy called double-extortion. Before encrypting a victim's files, operators exfiltrate sensitive data and threaten to publish it unless payment arrives. This approach adds enormous pressure on organisations because even those with robust backup systems face the prospect of public data leaks, regulatory fines, and reputational damage.

For businesses, this shift represents a fundamental change in risk calculation. A hospital system holding patient records or a financial firm managing client data cannot simply restore from backups and move on. The threat of disclosure transforms ransomware from a technical nuisance into an existential business threat. Insurance companies have noted sharp increases in cyber policy claims, with average payouts rising substantially over the past five years.

The Economics Driving Ransomware Proliferation

The ransomware industry generates billions annually. Research firms tracking cybercriminal revenue estimate that ransomware payments exceeded several billion dollars in recent years, though the true figure remains difficult to calculate given the preference for cryptocurrency transactions. The Gentlemen and similar groups operate with remarkable efficiency, treating their victims as customers and measuring success in payment conversion rates.

What makes these operations so lucrative is the low barrier to entry. Aspiring affiliates need only basic technical skills and internet access. The developers provide everything else—user-friendly interfaces, 24-hour support channels, and step-by-step guides. This democratisation of cybercrime means that dozens of distinct groups now compete for victims, creating what analysts describe as a saturated market where reputation matters enormously.

How The Gentlemen Targets Its Victims

Unlike opportunistic attacks that cast wide nets, The Gentlemen has demonstrated a preference for targeted operations. The group identifies high-value organisations—those with sensitive data, limited cybersecurity resources, or urgent operational pressures—and tailors its approach accordingly. Healthcare providers, educational institutions, and municipal governments have appeared frequently among reported victims.

Initial access often comes through phishing emails, exposed remote desktop protocols, or vulnerabilities in widely-used software. Once inside a network, attackers spend days or weeks mapping systems, identifying critical assets, and timing their encryption strike for maximum impact. The patience demonstrated by these operators suggests careful planning rather than hasty improvisation.

The Global Response and Its Limitations

Governments have escalated their response to ransomware threats. Sanctions against cryptocurrency exchanges, coordinated law enforcement operations against prominent groups, and diplomatic pressure on countries harbouring cybercriminals have all featured in the international response. Yet enforcement remains patchy. Many ransomware operators operate from jurisdictions with limited extradition treaties, effectively placing them beyond the reach of Western justice.

The economic consequence extends beyond individual ransom payments. Organisations spend heavily on prevention, incident response, and system rebuilding. Some sectors have seen insurance premiums double or triple as carriers reassess their exposure. Shareholders in cybersecurity firms have benefited from this spending surge, creating a perverse incentive structure where the threat benefits certain market segments.

What Businesses and Investors Should Watch

The ransomware landscape continues evolving. Groups periodically rebrand, splinter, or disappear entirely as law enforcement pressure mounts. New entrants replace shuttered operations, maintaining the overall volume of attacks despite intermittent victories against specific organisations. The Gentlemen itself has experienced periods of reduced activity followed by resurgence, a pattern common across the ransomware ecosystem.

For corporate leaders and investors, several indicators warrant attention. Regulatory requirements around breach disclosure vary significantly between jurisdictions, affecting what becomes public knowledge. Cryptocurrency tracing tools have improved, occasionally allowing investigators to follow ransom payments, though mixers and privacy coins complicate this work. Companies that have survived attacks show varying approaches—some have significantly upgraded defences, while others remain vulnerable to repeat incidents.

The ransomware economy shows no signs of shrinking. Until the financial incentives shift decisively against attackers—through improved international cooperation, technical countermeasures, or changes in how organisations handle the aftermath of breaches—groups like The Gentlemen will continue operating with business models that would impress any legitimate entrepreneur.