The GentlemenThreat actor
The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption…From MISP Galaxy
Last reported yesterday, by The Hacker News45 reports
ATT&CK techniques
6 of 86 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1684Social Engineering
“Social Engineering in the Age of Synthetic Media”
- T1021.001Remote Desktop Protocol
“…er 2026 Akira ransomware attack undertaken by Huntress found that "the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.”
- T1110Brute Force
“…Palo Alto Networks PAN-OS and Prisma Access) through bespoke Python scripts named "fortnew.py" and "exploit_2026_0257.py," or perform brute-force attacks using common username and password combinations, to obtain initial access.”
- T1003.001LSASS Memory
“T1003.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
45 reports · the newest 20, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“…ybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.”
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials“The threat actor is assessed to share connections with ransomware groups such as Qilin and The Gentlemen, likely operating as an initial access broker or an affiliate.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“With these numbers, n0n would have been the third-most active ransomware group in Q3, right behind Qilin and The Gentlemen (PDF), which is quite the achievement for a newly launched operation.”
-
I had plans for that second“INC and The Gentlemen Ransomware Affiliates expose 8,257 AI messages”
-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“The most successful ransomware groups were The Gentlemen (342 claimed incidents) and Qilin (339).”
-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy“During the reporting period, the two most prolific ransomware groups were The Gentlemen and Qilin.”
-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“From our investigation we also note victim overlaps with several ransomware groups such as Qilin and The Gentlemen, suggesting a possible relationship with ransomware operators or an Initial Access Broker (IAB) role However at this point of the investigation, the relationship bet…”
-
Japan Data Breaches 2026: Inside the October Surge“-Ransomware stayed steady: leak sites named 6 to 17 Japanese victims a month in 2026, and The Gentlemen overtook Qilin as the most active group against Japan”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“INC and The Gentlemen Ransomware: Exposed AI Infrastructure”
-
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks“Also new is The Gentlemen, a group running a ransomware-as-a-service operation.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“The most prolific gangs were Qilin and The Gentlemen.”
-
September 2026 Threat Trend Report on Ransomware“In September 2026, groups such as The Gentlemen, Qilin, Metaencryptor, CL0P, Storm, AUDIT TEAM, LockBit, EMPERADOR, and RansomHouse were active, and new groups like Vladivostok, Vexy, and BlackLocks also emerged.”
-
Q3 2026 Sets New Record for Ransomware Attacks““A prime example is The Gentlemen's recent attack on MIP Holdings (a South African tech company).”
-
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds“The threat intelligence specialist detailed the double cross in a new report, The Gentlemen Files, published on October 5.”
-
Ransomware group threatens to leak customer data from top insurance companies in South Africa“Ransomware-as-a-service group The Gentlemen threatened to leak data belonging to insurance companies LegalWise and Samwumed, with more South African companies likely to follow.”
-
Social Engineering in the Age of Synthetic Media“According to Recorded Future research, The Gentlemen ransomware group used Chinese models, including Kimi, DeepSeek, Qwen, and HUIHUI-AI, to automate payload generation and technical analysis and to triage exfiltrated personally identifiable information (PII).”
-
Threat Research Roundup: September 2026“This edition covers early infrastructure tied to The Gentlemen ransomware group, and attacker infrastructure targeting Amgen that the team spotted seven months before the company’s SEC filing.”
-
August 2026 Threat Trend Report on Ransomware“In August 2026, major groups such as The Gentlemen, Qilin, CL0P (Clop), Gunra, CRPx0, DragonForce, Orova, FulcrumSec, Emperador, and Helix continued their activities.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“GOLD SHERWOOD: Sophos has published insights from 15 intrusions that deployed The Gentlemen ransomware, which the company tracks as GOLD SHERWOOD.”
-
July 2026 Ransomware Trend Report“Existing groups such as The Gentlemen, DragonForce, Nova, Gunra, Everest, krybit, LockBit (LockBit 5.0), Qilin, Chaos, ShinyHunters, Morpheus, INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, Exf…”
Indicators in its reports
named in the reports above- infosec[.]exchangein 2 reports
- 45.227.254[.]43in 2 reports
- railway[.]comin 1 report
- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- 95.sbx[.]tgin 1 report
- fbijobs[.]govin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.