What happened
Security journalist Brian Krebs has published an investigation tracing real-world identity clues tied to the administrator of a ransomware collective called The Gentlemen, now ranked as the second most prolific ransomware operation by victim count. The group has grown rapidly by offering affiliates an unusually generous 90 percent cut of ransom payments, a recruitment model that has drawn skilled threat actors at pace. Separately, the 2026 Cybersecurity Stars Awards recognized standout contributors across 95 subcategories, shining a rare public light on products, teams, and organizations whose defensive work typically goes unnoticed by design.
Why it matters for your business
The Gentlemen's affiliate-revenue model represents a structural escalation in ransomware economics: when operators surrender nearly all ransom proceeds to retain talent, they are effectively running a franchise optimized for volume and speed over discretion. That means more attacks, faster negotiations, and less predictable adversary behavior for victims. Organizations that have not audited their incident-response retainers, cyber-insurance coverage, and backup integrity recently are carrying compounding exposure. The Stars Awards findings are a practical signal for procurement teams — recognized products and teams represent independently vetted options worth prioritizing in vendor shortlists and hiring pipelines.
What to watch next
Law enforcement action against The Gentlemen's administrator, if Krebs's attribution holds, could disrupt affiliate confidence across the broader ransomware-as-a-service ecosystem — a pattern seen after previous operator takedowns. Concurrently, the growing public profile of cybersecurity award programs suggests the industry is maturing toward clearer performance benchmarks, which may accelerate enterprise buying decisions and talent mobility in the second half of 2026.