The Gentlemen: When Ransomware-as-a-Service Becomes an Industry

The Gentlemen, a Russian-speaking RaaS group emerging mid-2025, has industrialised ransomware operations with 1,570+ compromised networks across 70+ countries using a structured affiliate model paying 90-97% revenue share. A breach of their hosting provider exposed internal operations, revealing how modern ransomware groups now operate with recruitment, compensation policies, innovation cycles, and outsourcing practices identical to legitimate SaaS businesses. Ransomware operators now pay 90-97% of ransom to affiliates and recruit like SaaS companies recruit engineers. If you build endpoint detection, incident response, or backup infrastructure, your customer's attack surface just became someone's profitable business model - and that someone has funding and retention discipline.