The Gentlemen RaaS Scales to 166 Victims as Ransomware Groups Compete for Affiliates

Two new Ransomware-as-a-Service (RaaS) entrants publicly recruited affiliates, underscoring a rapid reconsolidation of the ransomware market and a sharpening competition for skilled operators.

An actor using the handle hyflock123 posted a recruitment thread on Duty-Free on May 14 claiming prior work with LockBit and Qilin and launching “Hyflock.”

The next day hastalamuerte, founder and administrator of The Gentlemen RaaS group, ran a high-profile recruitment campaign on BreachForums offering affiliates a 90% revenue share; BreachForums publicly confirmed the partnership on May 16.

Both launches came during a quarter that saw 2,122 leak-site victims, the second-highest Q1 total on record, and illustrate how former members of large operations are repackaging institutional knowledge into new brands.

Key intelligence points matter for defenders. The Gentlemen scaled astonishingly fast, rising from 40 victims in Q4 2025 to 166 in Q1 2026 a 315% jump that placed the group third globally in some forum-based rankings and aligns with external tracking by Check Point.

Its public recruitment pitch emphasizes economics and autonomy: affiliates keep 90% of ransoms, control victim negotiations, and receive builds that automatically embed affiliate contact details into ransom notes.

The operator advertises a Go-based cross-platform locker for Windows, Linux, NAS, and BSD that uses modern cryptography with per-file ephemeral keys, plus a compact ESXi locker in C.

Notably, the Gentlemen’s locker claims to run without administrator privileges and offers modes designed to minimize disk I/O and evade naive filename-change detection, which increases the need for behavioral detection across many endpoints.

Gentlemen RaaS Scales to 166 Victims

Hyflock’s public pitch centers on claimed lineage and integrated tooling. The actor hyflock123 asserts prior LockBit and Qilin experience a self-reported claim that cannot be independently verified and offers what it calls an “all-in-one” panel combining initial-access purchasing, automated negotiation rooms, AI-driven victim analysis, and a dedicated red team to support affiliates.

According to flare, Hyflock promises rapid encryption (marketing claims of “twice the speed of LockBit” lack third-party benchmarks) and a sliding operator cut that becomes highly affiliate-friendly after the first job.

Its distinguishing structural change is a marketplace model that bundles access brokers, negotiation, and deployment in one interface, which shortens the time from intrusion to ransomware execution and further lowers the skill barrier for effective operations.

These developments occur within a market that is reconsolidating. Forum analysis and external trackers show the top 10 ransomware groups accounted for roughly 71% of Q1 2026 victims, favoring scale and making aggressive affiliate economics a competitive lever.

The Gentlemen’s 90% offer and Hyflock’s rapid escalation to 80–85% cuts put pressure on incumbent operators to match affiliate-friendly splits, incentivizing pentesters and access brokers to migrate toward newer brands.

For defenders the implications are clear: faster, stealthier encryption that runs without elevated privileges, GPO-based lateral spreading, and explicit targeting of cloud backups require adjusted detection and response.

Prioritize behavior-based monitoring on Linux, NAS, ESXi, and non-elevated Windows processes; log and alert on rapid partial-file writes and unusual Group Policy changes; and treat any encryption event as a data-exfiltration incident until proven otherwise.

Monitor forums and leak sites for affiliate recruitment and access listings as early-warning signals Flare, Check Point, and other threat intelligence sources indexed the relevant threads within hours and factor in the likelihood that new RaaS entrants are importing craft from previous large operations.

The race for affiliates is now a driver of technical innovation in ransomware, and defenders must move detection earlier in the kill chain to blunt these faster, more accessible threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.