The Gentleman's Broker: Unmasking the Operator Behind "Hastalamuerte"
A cross-referenced digital footprint places the ransomware group's initial access broker in Izhevsk, Udmurt Republic, tied together by one recycled ProtonMail address, one phone number, and a decade of consumer-grade data exhaust.
In the underworld of ransomware-as-a-service, an initial access broker is a specialist middleman: someone who doesn't build the malware or negotiate the ransom, but who breaks into corporate networks, or buys entry from someone who already has, and hands the keys to an affiliate crew. IntelHawk's investigative unit has spent the past several weeks tracing one such broker, known across cybercrime forums and encrypted chats as Hastalamuerte, back through a decade of leaked consumer records to a single name in Russia's Udmurt Republic.
What follows is not a courtroom finding. It is an open-source intelligence assessment, built from breach-forum dumps, historical cybercrime archives, and chat logs scraped in the course of IntelHawk's monitoring operations, that a reasonable analyst would treat as strong grounds for further investigation, not as proof beyond doubt. We've laid out exactly where the evidence is airtight, and exactly where it thins out into inference.
01Who Is Hastalamuerte?
The handle first surfaces repeatedly across cybercrime-forum data and in chat logs scraped as part of IntelHawk's ongoing monitoring of Gentleman ransomware infrastructure. In those chats, the actor operating as Hastalamuerte describes a specific function within the group: sourcing and purchasing initial access into victim networks, then handing that access off for exploitation. It's a role that requires neither elite malware development skills nor the front-facing negotiation work of a ransomware "spokesperson"; it requires patience, a network of sellers, and a working relationship with an affiliate program.
| Identifier | Assessment | Basis |
|---|---|---|
| Hastalamuerte / hastalamuerte | High | Repeated appearance across cybercrime-forum data and IntelHawk-scraped chat logs. |
| [email protected] | High | Directly paired with the Hastalamuerte username in BreachForums records. |
| Telegram @hastalamuerte18 | High | Actor-provided handle recorded in historical archives and forum dumps; corroborated by scraped chats. |
| Gentleman ransomware / IAB role | High | Described directly by the actor in scraped chat logs: obtains and purchases initial access on the group's behalf. |
The Gentleman brand itself carries a certain black-humored theatricality typical of the current ransomware scene: polite, formal correspondence with victims, a tidy leak-site aesthetic. Whoever operates under Hastalamuerte doesn't set that tone; they work several layers back in the supply chain, closer to the access than to the extortion.
02One Email, Six Accounts
The strongest thread in this investigation is almost embarrassingly simple: the ProtonMail address [email protected] was tested for registration across a range of mainstream services, and came back positive on every one.
| Service | Category | Result | Notable Detail |
|---|---|---|---|
| Firefox | Technology | Registered | Account tied to the tested address. |
| Apple | Technology | Registered | Masked recovery phone ends in "04," consistent with the phone number tied to the broader identity cluster (see below). |
| GitBook | Development | Registered | Account tied to the tested address. |
| OpenAI | AI / Developer | Registered | Password authentication; email confirmed. |
| Proton | Communication | Registered | RSA 2048-bit PGP key; key UID embeds the same address, created July 28, 2018. |
| Hugging Face | AI / Developer | Registered | Account tied to the tested address. |
| GitHub, S0me1-dev ("Santa") | Development | 90/100 | Registration data directly links the profile to the tested address. |
None of this, on its own, proves who was logged into these accounts on any given day; a registered email tells you who opened the account, not who's been running it since. But six independent developer and consumer platforms all keyed to one purpose-built ProtonMail address, alongside a GitHub developer profile, paints a consistent picture of someone maintaining a professional-grade operational identity: an actor comfortable enough with infrastructure to be registering on GitHub and Hugging Face, not just cybercrime forums.
03The Long Tail: A Decade of Leaked Consumer Data
Beyond the ProtonMail cluster, IntelHawk's graph pulled in 60 distinct data points (deduplicated from 73 raw records) tying the Hastalamuerte username and its variants to a scattershot of consumer breaches spanning nearly ten years: music streaming services, social platforms, an electronic-money exchanger, food delivery apps, and Russian government service portals.
Individually, these are weak signals: a shared username across breach dumps is the OSINT equivalent of a common surname. IntelHawk's assessment treats them exactly that way: as low-confidence leads, not confirmed accounts, and explicitly warns against treating a username collision as proof of ownership. What makes the cluster worth publishing is what happens when you follow the strongest of these threads, the courier and banking records, toward a name.
04Following the Money: From "bu4vs" to a Name
A second, older identity cluster runs through the alias bu4vs and the mailbox [email protected], a handle that predates the Hastalamuerte persona by several years and recurs across an unusually wide spread of everyday Russian consumer services: a currency exchanger, a classifieds site, a delivery courier, a food-delivery app, a retail chain, and, more consequentially, a driver's license and government-services record.
| Source | What It Shows |
|---|---|
| Obmen4you.com (2022 breach, ~22K users) | Email [email protected], nickname bu4v, account created January 2019, historical IP 85.140.4.44. |
| Avito (2014–2018) | Classifieds listings tied to the same email, based in Izhevsk and the broader Udmurtia region across multiple years. |
| CDEK courier (2022) | Full name recorded as Yapayev Aleksandr Andreyevich, linked to a secondary Gmail address. |
| AlfaBank (2023) | Account holder recorded as ЯПАЕВ АЛЕКСАНДР АНДРЕЕВИЧ, date of birth 1989-07-19. |
| Russian driver's license / Gosuslugi records | Full name and Izhevsk address recorded consistently, date of birth 19.07.1989. |
| Telegram (2020) | Handle @bu4vs, tied to the same phone number as the identity cluster. |
Name spellings drift a little across records: Yapaev, Yapayev, and a probable OCR/transliteration variant "Яфаев" all appear, which is exactly what you'd expect from records pulled across a decade of different Cyrillic transliteration conventions, not a red flag in itself.
The Identity Cluster, At a Glance
Government identification numbers, the precise residential address, and recovered password hashes have been withheld from this published account. They are retained in IntelHawk's restricted case file for authorized use, consistent with the source report's confidential handling designation.
05What This Means
This is intelligence, not a final determination, and it should be verified by valid subpoenas to further gather evidence.
