Group-IB
Singapore-headquartered cybersecurity investigations firm that documented a ransomware affiliate's split from Qilin.
Group-IB, a Singapore-headquartered investigations firm, documented on 19 March 2026 that ransomware operation The Gentlemen split from Qilin's affiliate programme after a $48,000 commission dispute.
Last refreshed: 3 August 2026
Timeline for Group-IB
Documented The Gentlemen's origin as a Qilin affiliate that split off in July 2025
Cybersecurity: Threats and Defences: Qilin's own affiliate now outposts itBackground
Group-IB is a Singapore-headquartered cybersecurity investigations firm that tracks ransomware operations and their affiliate structures. On 19 March 2026 it reported that The Gentlemen, a ransomware operation now running its own leak site, began inside Qilin's affiliate programme under the handle ArmCorp before splitting off around 22 July 2025 following a dispute over a $48,000 revenue share.
Group-IB put The Gentlemen at roughly 20 members at the time of its report, with an affiliate revenue share under Qilin of 70 to 80 per cent, figures that give scale to how significant the commission dispute was relative to the group's existing arrangement.