What happened
Group-IB researchers have detailed a phishing campaign attributed to the Sniper Dz operation, targeting users across the Middle East and North Africa through fraudulent Facebook profiles impersonating politicians, government agencies, and well-known public figures. The fake accounts lured victims with fabricated offers — free mobile data packages, financial relief payments, and government subsidy schemes — alongside deceptive browser alerts designed to harvest credentials. Separately, cybersecurity journalist Brian Krebs published an investigation into The Gentlemen, a ransomware collective that has climbed to second place globally by victim count. The group draws skilled affiliates by offering a 90 percent revenue share on ransoms collected — a cut significantly higher than industry norms among criminal networks.
Why it matters for your business
The Sniper Dz campaign illustrates how social-engineering attacks are becoming more contextually convincing, weaponizing regional trust signals such as government branding and local subsidy programs to bypass skepticism — a tactic that scales easily to other geographies. Organizations with employees or customers in the MENA region should audit their social media impersonation exposure and reinforce phishing-awareness training with region-specific examples. The Gentlemen's aggressive affiliate model is a structural warning: high commission structures accelerate recruitment of technically capable actors, meaning the group's operational tempo and target diversity are likely to grow quickly. Security teams should treat The Gentlemen as an active, scaling threat and ensure ransomware response playbooks are current and tested.
What to watch next
Krebs's investigation points to potential real-world identity leads for The Gentlemen's administrator — any law enforcement action stemming from that research could disrupt the group or trigger retaliatory escalation in attack volume. On the phishing front, monitor whether Sniper Dz expands beyond MENA, since the playbook of impersonating trusted local institutions translates readily to other markets. Both stories underscore a broader pattern of professionalizing cybercrime infrastructure that security teams should factor into their 2026 threat modeling.