A ransomware group that pays 90% of its revenue to its affiliates. Enough to make a start-up’s remuneration committee go pale.
Farrah Bourra documents The Gentlemen case for INCYBER: it appeared in mid-2025 and has claimed more than 340 victims in more than 70 countries.
So far, one group among others.
Except that Check Point Research counts 1,570 compromised corporate networks. Nearly five times what their leak site shows. Most of the activity leaves no public trace.
And the organisation looks exactly like a software vendor. Developers who maintain the product and the infrastructure. Affiliates recruited on performance, with a 90% cut and up to 97% on extortion campaigns without encryption.
Why does it concern us, who work in interconnection?
Because an industrialised threat hits the real world with a force as great as its scale.
At Mackay Sugar, Australia’s second-largest raw sugar producer, the attack halted part of the Queensland mills for nearly a week. Cyber moves from the digital to the physical world. And in this example, it was agricultural production that suffered.
The question is about interconnection paths: how many do I have? Through whom and where do they run? And who do they really depend on?
Resilience can be bought, provided you are very clear about your needs, with specifications that spell out, line by line: path diversity, robustness, independence…
We keep working on it. The story continues. 🤝
Peering Essentiel
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post