← Back

Wire · founder news, decoded · operational-macro

The Gentlemen: When Ransomware-as-a-Service Becomes an Industry

Published

17 July 2026

Topic

operational-macro

Sectors

Cybersecurity

Geography

United States

Source

Read at incyber.org

Verified

Fusion42 · 17 July 2026 · Fusion42 review

The Gentlemen, a Russian-speaking RaaS group emerging mid-2025, has industrialised ransomware operations with 1,570+ compromised networks across 70+ countries using a structured affiliate model paying 90-97% revenue share. A breach of their hosting provider exposed internal operations, revealing how modern ransomware groups now operate with recruitment, compensation policies, innovation cycles, and outsourcing practices identical to legitimate SaaS businesses.

This Wire brief sits within Fusion42's coverage of Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.

The Wire takeaway

Ransomware operators now pay 90-97% of ransom to affiliates and recruit like SaaS companies recruit engineers. If you build endpoint detection, incident response, or backup infrastructure, your customer's attack surface just became someone's profitable business model - and that someone has funding and retention discipline.

Related on Wire

Topics

Cybersecurity · ransomware-as-service · raas-economics · affiliate-models · cyber-operations · threat-evolution · double-extortion