Source
r/pwnhub•
_clickfix_

Russian Ransomware Operator Chat Logs Show Years of Gradual Skill-Building Before Major Criminal Enterprise

Newly surfaced chat logs from a 2020 Telegram hacking training channel have emerged as key evidence in the unmasking of the administrator behind The Gentlemen, currently the second most active ransomware group by victim count in 2026, with more than 332 victims since the group's inception in mid-2025.

Sources

Background: Who Is Hastalamuerte?

According to the KrebsOnSecurity investigation published June 10, 2026, researchers at Check Point Software, Intel 471, Flashpoint, and Constella Intelligence traced a persona using the handles Hastalamuerte and later Zeta88 across nearly a dozen cybercrime forums over six years. The trail ultimately led to Alexander Andreevich Yapaev, a 36-year-old from Izhevsk, the capital of Russia's Udmurt Republic, who simultaneously maintained a LinkedIn profile listing himself as head of B2B marketing at Uralenergo Udmurtia.

Key linkages researchers identified:

  • The email hastalamuerte1488@protonmail.com was used to register on Raidforums in 2020 and is connected to an Apple account and a Russian phone number ending in 04
  • That phone number appears in hacked Russian government databases assigned to Yapaev
  • A GitHub account under the name SantaMuerte, linked to the same email, shows activity involving malware tools and exploits
  • On the hacking forum Codeby, the SantaMuerte account originally registered under the name Alexandr 4apaev (the numeral 4 substitutes for "ch" in informal Russian)
  • Both Hastalamuerte and the later alias Zeta88 registered on Breachforums from Internet addresses in Izhevsk

The Training Channel Logs

In June 2020, Hastalamuerte joined a paid multi-month Telegram training program (@pntst) focused on penetration testing tools. The full translated logs are publicly available and document someone who was, at that stage, a relatively unsophisticated operator still learning foundational techniques.

Struggling With Basic Tools

The logs show repeated difficulty getting sqlmap, one of the most widely used and well-documented SQL injection tools, to function correctly:

"I keep getting this exact error consistently -- with a VPN, with any location, even without a VPN -- whether using -u or -r."

And later, after still failing to resolve it:

"It's the same error on both Windows and Linux; first time I've encountered this. It's mentioned a couple of times in the sqlmap issues, but even Stamparm can't really explain it there."

Infected by the Tools They Were Trying to Use

In a telling episode, the user obtained a cracked copy of the professional vulnerability scanner Nexpose from a criminal forum, only to have it compromise their own machine:

"Pants full of malware... last night was like exterminating cockroaches; then the locker showed up and crushed them."

"I picked up some 'Enterprise' Trojans while using Nexpose; I battled them for 6 hours, but they won."

The user also described a protracted dispute with a forum vendor over a broken crack:

"I spent two weeks arguing with 'Dark Lord' over there because he posted a broken Nexpose crack and called me a moron for pointing out that it didn't work -- plus, there was malware in it too. In the end, he fixed it and released it to the 'chosen few.'"

Relying Heavily on Automated Scanners

Rather than demonstrating deep technical knowledge, the logs show a user heavily dependent on commercial and cracked scanning tools including Acunetix, Netsparker, Burp Suite Pro, AppSpider, and Metasploit Pro, often unsure how to interpret or act on their output:

"If Netsparker reports 'probable,' and AppSpider finds 4 attack vectors -- 3 resulting in syntax errors and the 4th in an 'Unknown column' error -- and sqlmap just won't work when I run it manually, is that the end of the road?"

"I really want to finish configuring AppSpider..."

Asking Instructors for Help With Basic Exploits

At one point the user publicly thanked their instructor for walking them through a foundational technique:

"I'd like to express my gratitude to Comrade Teacher for helping me get that nasty SQLi exploit running. By the way, Union is available there too now, so no need to suffer."

Legal Risk, Acknowledged and Dismissed

Despite discussing clearly unauthorized access to live systems, the group treated legal exposure as a joke:

"Everything here is strictly for educational purposes. So it's all good."

"Out of mercenary motives (and who dumps databases for free...)"

From Training Channel to Ransomware Kingpin

The contrast between those 2020 logs and Hastalamuerte's current operation is stark. As Zeta88, the same individual now administers The Gentlemen ransomware group, which Check Point describes as the second most prolific ransomware operation active in 2026. Key characteristics of the current operation include:

  • A 90/10 affiliate revenue split, compared to the industry standard 80/20, which has accelerated recruitment of experienced operators from competing ransomware programs
  • More than 240 victims claimed in 2026 alone
  • Primary entry through Internet-facing devices such as VPNs and firewalls, with full network encryption typically achieved within hours
  • According to PRODAFT's detailed threat report, the administrator now uses AI to develop and maintain the ransomware and associated tooling, as well as to assist with post-exploitation activity
  • Affiliates receive Fortinet SSL-VPN credentials directly from the administrator, obtained through brute-force attacks or sourced from the group's own leak database

Why the Trail Was So Easy to Follow

Researchers note that the extensive digital footprint Hastalamuerte left between 2019 and 2021 is not unusual. Cybercriminals early in their careers tend to be far less cautious, registering on forums with consistent usernames, reusing email addresses, and posting from home IP addresses. By the time they have enough to lose to care about operational security, the early trail is already permanent.

Russia's general policy of tolerating cybercriminal activity directed at foreign targets also reduces domestic pressure to stay hidden, particularly for operators who are not yet running high-profile internationally visible operations.

Mr. Yapaev did not respond to multiple requests for comment.

Sources: KrebsOnSecurity, Check Point Software, Intel 471, Flashpoint, Constella Intelligence, PRODAFT

Posted Jun 13, 2026, 5:25 PM UTC

11
Loading comments…