As cited
Copy frozen at (site build).
ransomware
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen ransomware-as-a-service (RaaS) group operated a separate leak site while extorting roughly two dozen victims, capturing ransom payments intended for the operator. The affiliate diverted funds by threatening to publish stolen data independently, bypassing the RaaS operator's commission structure.
Why it matters: Organizations targeted by The Gentlemen and similar RaaS groups face increased financial risk when affiliates act unilaterally; security teams should expect ransom demands from multiple threat actors claiming the same breach and verify victim notifications through official channels.
- Source published
- First seen by Cybersecurity Tracker