Qilin's own affiliate now outposts it

Leak-site postings logged by ransomware.live between 24 July and 3 August ran The Gentlemen at 31 victims and Qilin at 19⁠¹. A leak site is the extortion shopfront where a crew publishes the names of organisations it says it has breached, so the count measures claims made rather than intrusions verified. Group-IB, the Singapore-headquartered investigations firm, documented on 19 March that The Gentlemen, which also trades as Hastalamuerte, began life inside Qilin's affiliate programme under the handle ArmCorp⁠².

Group-IB traces the split to money. A public argument over $48,000 of unpaid commission split the crew off around 22 July 2025, and a Windows ransomware sample from the new operation had already reached VirusTotal on 17 July 2025, five days before the falling-out; the administrator later admitted building his own locker while still earning under Qilin's programme⁠³. Affiliate exits on this beat tend to get read as consequences of law-enforcement pressure. This one was a payroll dispute in a business with payroll disputes like any other, planned in advance.

The two published figures for what The Gentlemen pays its affiliates do not agree, and the disagreement matters more than the gap. Group-IB puts the crew at roughly 20 members and the affiliate share at 70 to 80 per cent of receipts⁠⁴. The group profile on ransomware.live gives 90 per cent⁠⁵. Group-IB publishes named investigative analysis; ransomware.live aggregates tracker metadata, much of it what the crews say about themselves. Any recruitment-economics argument built on either number stays unfalsifiable until one of the two is withdrawn.

This briefing owes readers a correction on the same subject. On 30 June we reported that BlackFog's June figures named Qilin the most active brand for a second consecutive month. They do not. BlackFog's June edition puts a newly emerged group trading as 2019 at the head of the month with 12 claimed victims out of 102 attacks across 31 active groups⁠⁶. Qilin led May, with 11 of the 95 attacks BlackFog counted across 37 groups, and did not lead twice.

The ten-day posting count and BlackFog's monthly tally are not the same measurement, from the same tracker, on the same basis, and BlackFog has not published July, so the inversion reads as a lead rather than an overtake. The larger problem sits under both numbers. A brand table treats The Gentlemen and Qilin as two operations when the first is staffed out of the second, and it credits a leader with under 12 per cent of a month's activity. Check Point Research sinkholed the crew's SystemBC command server, which is how it first reached this beat as a single line on 19 April.