The Gentlemen (ransomware group)

The Gentlemen is a ransomware-as-a-service (RaaS) group. The group has been operational since mid-2025, though it only became known publicly in September 2025.[1][2][3][4][5][6] The Gentlemen’s tactics involve extensive reconnaissance [7] and tooling that adapts to the victims’ environments, with the group linked to attacks on organizations in multiple countries.[2] The group was first publicly documented in a report by Trend Micro and has since been reported on by Microsoft, Check Point, Group-IB, Cybereason, and other security companies.[1][2][3][4][5]

Background and origins

According to Group-IB and other researchers, The Gentlemen developed from a pre-existing operation that had previously functioned as "ArmCorp," an affiliate of the Qilin ransomware group.[8] The public break came on 22 July 2025, when a Russian-speaking actor using the handle "hastalamuerte" (identified as the principal operator of the group[4][9]) opened an arbitration thread on the RAMP underground forum, accusing Qilin's operators of withholding approximately $48,000 in affiliate commission.[4]

Researchers have noted that the first Windows sample of The Gentlemen ransomware was uploaded to VirusTotal on 17 July 2025,[4][10] before the public dispute, and that it already contained the group's data leak-site URL.[4]

The Gentlemen started as a closed ransomware group before switching to a RaaS model in September 2025. It has a formal agreement with the criminal forum and marketplace BreachForums to find new affiliates, specifically penetration testers[3][9] and initial access brokers.[1]

As with several other Russian-speaking groups, researchers report that the operators avoid targeting Russia and the Commonwealth of Independent States.[5]

Operations

Researchers describe The Gentlemen as using a double-extortion ransomware model, which involves affiliates exfiltrating data before encrypting systems and threatening to publish stolen information on a leak site on the dark web if a ransom is not paid.[1][2][3][4][5][6]

The group advertises its tooling on underground forums and operates an affiliate program, with affiliates being offered up to 90 percent of ransom proceeds.[9]

In its initial report, Trend Micro noted that the attackers changed their tooling during a single campaign, shifting from generic anti-antivirus utilities to variants targeting the specific security products found in the victim’s environment.[2]

The Gentlemen runs an onion site for leaking data of victims who refuse to pay a ransom. Ransom negotiations happen through each affiliate’s own Tox ID (peer-to-peer instant messaging protocol).[3]

Technical characteristics

The Gentlemen ransomware is written in the Go programming language,[11] with multi-OS lockers available for affiliates[3] (a Go-based locker covering Windows, Linux,[12] Network Attached Storage, and Berkeley Software Distribution, plus a separate C-based locker for ESXi hypervisors[13]). Microsoft has described the encryptor as self-propagating.[1]

The group usually gains its first foothold through internet-facing edge devices like VPNs (virtual private networks) and firewalls (especially Fortinet FortiGate and Cisco), using a mix of password brute-forcing, exploiting known unpatched vulnerabilities, buying ready-made access from brokers, and hunting for reusable credentials in data-breach search engines, then uses that foothold as a pivot to move deeper into the network.[9]

Once inside, the attackers map the network and escalate their privileges toward domain administrator access (using Active Directory discovery, certificate abuse, and local exploits) while simultaneously trying to bypass or disable defenses like EDR (endpoint detection and response) tools and antivirus through misconfigurations, registry and log tampering, and BYOVD (bring-your-own-vulnerable-driver[14]) techniques that overwrite security software.[4][7][9]

The Gentlemen then spreads across the network, sets up hidden backup connections, steals credentials and active browser sessions, exfiltrates data, and deploys their custom locker to encrypt everything at once.[9]

Targets and reported scale

The Gentlemen has claimed over 400 victims across more than 70 countries since the group first appeared.[6]

Most of the group's claimed victims appeared in early 2026, and its claimed volume during that period was second to Qilin and ahead of groups such as Cl0p, RansomHub, and LockBit.[7][15][16] These figures come from the group's own leak-site claims and have not been independently verified.[9]

Affected sectors included manufacturing, technology, construction, energy and utilities, healthcare, insurance, education, transportation, and financial services industries.[1][2][17][18][19][20] Geographically, The Gentlemen has targeted organizations in APAC, Europe, Latin America, the United States, Canada, the Middle East, and Africa.[21]

Public exposure

In May 2026, The Gentlemen’s internal Rocket.Chat communications infrastructure was breached, and an archive of its data, spanning November 2025 to late April 2026, was offered for sale on 5 May before being released freely on several cybercrime forums on 8 May, exposing detailed information about the group's structure, tooling, victim targeting, and negotiation tactics.[22][23]

After the leak, the group's administrator announced a complete rebuild of its communication infrastructure, new storage systems, and upgrades to the locker.[24]

References

  1. 1 2 3 4 5 6 Intelligence, Microsoft Threat (2026-05-28). "The Gentlemen ransomware: Dissecting a self-propagating Go encryptor". Microsoft Security Blog. Retrieved 2026-06-03.
  2. 1 2 3 4 5 6 "Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed". Trend Micro. 2025-09-09. Retrieved 2026-06-03.
  3. 1 2 3 4 5 6 antoniost@checkpoint.com (2026-04-20). "DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy". Check Point Research. Retrieved 2026-06-03.
  4. 1 2 3 4 5 6 7 8 "How Hastalamuerte Operates: Group-IB's Analysis of The Gentlemen's Attack Methods". Group-IB. Retrieved 2026-06-03.
  5. 1 2 3 4 Team, Cybereason Security Services. "License to Encrypt: "The Gentlemen" Make Their Move". www.cybereason.com. Retrieved 2026-06-03.
  6. 1 2 3 Mousqueton, Julien. "Group: thegentlemen". Ransomware.live. Retrieved 2026-06-03.
  7. 1 2 3 Schwartz, Mathew J. (May 11, 2026). "Tables Turned: Gentlemen Ransomware Group Suffers Data Leak". www.bankinfosecurity.com. Retrieved 2026-06-03.
  8. ↑ Mascellino, Alessandro (2026-03-19). "Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation". Infosecurity Magazine. Retrieved 2026-06-03.
  9. 1 2 3 4 5 6 7 stcpresearch (2026-05-13). "Thus Spoke…The Gentlemen". Check Point Research. Retrieved 2026-06-03.
  10. ↑ "VirusTotal". www.virustotal.com. Retrieved 2026-06-03.
  11. ↑ "'The Gentlemen' Rapidly Rises to Ransomware Prominence". Dark Reading. Archived from the original on 2026-04-26. Retrieved 2026-06-03.
  12. ↑ Underhill, Ken (2025-11-21). "These 'Gentlemen' Aren't Gentle: Rapidly Evolving Ransomware Threat". eSecurity Planet. Retrieved 2026-06-03.
  13. ↑ Toulas, Bill. "The Gentlemen ransomware now uses SystemBC for bot-powered attacks". BleepingComputer. Retrieved 2026-06-03.
  14. ↑ "'Gentlemen' Ransomware Abuses Vulnerable Driver". Dark Reading. Archived from the original on 2026-05-14. Retrieved 2026-06-03.
  15. ↑ Moody, Rebecca (2026-04-08). "Ransomware roundup: Q1 2026". Comparitech. Retrieved 2026-06-03.
  16. ↑ "The Gentlemen emerging as key ransomware player | Computer Weekly". ComputerWeekly.com. Retrieved 2026-06-03.
  17. ↑ "Ransomware upstart 'The Gentlemen' raises the stakes for OT‑heavy sectors". CSO Online. Retrieved 2026-06-03.
  18. ↑ Paganini, Pierluigi (2025-12-29). "Romania's Oltenia Energy Complex suffers major ransomware attack". Security Affairs. Retrieved 2026-06-03.
  19. ↑ Bathgate, Rory (2026-05-29). "'The Gentlemen' becomes fastest-growing ransomware as industrial sector hit hard". National Technology. Retrieved 2026-06-03.
  20. ↑ Woollacott, Emma (2026-05-27). "New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacks". IT Pro. Retrieved 2026-06-03.
  21. ↑ Asokan, Akshaya (September 10, 2025). "'The Gentlemen' Ransomware Targets Asia Pacific". www.bankinfosecurity.com. Retrieved 2026-06-03.
  22. ↑ Ransom-ISAC (2026-05-15). "The Gentlemen Ransomware Group — Leak Analysis". Ransom-ISAC. Retrieved 2026-06-03.
  23. ↑ Staff, S. C. (2026-05-18). "Ransomware group 'The Gentlemen' suffers internal breach, exposing operations". SC Media. Retrieved 2026-06-03.
  24. ↑ "The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record". www.halcyon.ai. Retrieved 2026-06-03.
This page is issued from Wikipedia. The text is available under Creative Commons Attribution-Share Alike 4.0 unless otherwise noted. Additional terms may apply for the media files.