Group-IB
Singapore-headquartered cybersecurity investigations firm that documented a ransomware affiliate's split from Qilin.
Group-IB's 19 March 2026 finding that The Gentlemen began as Qilin affiliate ArmCorp framed the year's leading ransomware rivalry: by September The Gentlemen led leak-site claims with 106, while Qilin's more than halved to 74.
Last refreshed: 12 October 2026
Timeline for Group-IB
Mentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesMentioned in: Police seize KillSec ransomware leak site
Cybersecurity: Threats and DefencesDocumented The Gentlemen's origin as a Qilin affiliate that split off in July 2025
Cybersecurity: Threats and Defences: Qilin's own affiliate now outposts itBackground
Group-IB is a Singapore-headquartered cybersecurity company that investigates cybercrime and tracks ransomware operations, including how affiliates move between brands.
Its 19 March 2026 report on The Gentlemen supplied the origin story for the year's most visible ransomware rivalry: the operation began as the Qilin affiliate ArmCorp and broke away around 22 July 2025 over a $48,000 payment dispute. Group-IB put the crew at roughly 20 members, with a 70 to 80 per cent affiliate revenue share under Qilin, figures that show how small the sum behind the split was against the arrangement it ended.
That attribution gives later leak-site counts their meaning. When ransomware.live and other trackers report The Gentlemen overtaking Qilin, Group-IB's work establishes that the challenger grew from Qilin's own ranks.
Group-IB traced a rival to Qilin
Group-IB documented on 19 March that The Gentlemen, which also trades as Hastalamuerte, started life as ArmCorp, an affiliate working under Qilin's programme, before a quarrel over $48,000 in commission drove it out around 22 July 2025. Its analysis found a Windows ransomware sample from the new operation on VirusTotal on 17 July 2025, five days before the split, and put the crew at roughly 20 members on a 70 to 80 per cent affiliate share.
That lineage became the frame for later leak-site tracking. Between 24 July and 3 August 2026 The Gentlemen out-posted Qilin 31 to 19, and in September it led all crews with 106 claims. Each swap at the top has been read against Group-IB's account of where the rival came from.
Who is behind The Gentlemen ransomware group?
Why did The Gentlemen split from Qilin?
What is Group-IB?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.