The Gentlemen is a ransomware-as-a-service (RaaS) group. The group has been operational since mid-2025, though it only became known publicly in September 2025. The Gentlemen’s tactics involve extensive reconnaissance and tooling that adapts to the victims’ environments, with the group linked to attacks on organizations in multiple countries. The group was first publicly documented in a report by Trend Micro and has since been reported on by Microsoft, Check Point, Group-IB, Cybereason, and other security companies.
Background and origins According to Group-IB and other researchers, The Gentlemen developed from a pre-existing operation that had previously functioned as "ArmCorp," an affiliate of the Qilin ransomware group. The public break came on 22 July 2025, when a Russian-speaking actor using the handle "hastalamuerte" (identified as the principal operator of the group) opened an arbitration thread on the RAMP underground forum, accusing Qilin's operators of withholding approximately $48,000 in affiliate commission.
Researchers have noted that the first Windows sample of The Gentlemen ransomware was uploaded to VirusTotal on 17 July 2025, before the public dispute, and that it already contained the group's data leak-site URL.
The Gentlemen started as a closed ransomware group before switching to a RaaS model in September 2025. It has a formal agreement with the criminal forum and marketplace BreachForums to find new affiliates, specifically penetration testers and initial access brokers.
As with several other Russian-speaking groups, researchers report that the operators avoid targeting Russia and the Commonwealth of Independent States.
Operations Researchers describe The Gentlemen as using a double-extortion ransomware model, which involves affiliates exfiltrating data before encrypting systems and threatening to publish stolen information on a leak site on the dark web if a ransom is not paid.
The group advertises its tooling on underground forums and operates an affiliate program, with affiliates being offered up to 90 percent of ransom proceeds.
In its initial report, Trend Micro noted that the attackers changed their tooling during a single campaign, shifting from generic anti-antivirus utilities to variants targeting the specific security products found in the victim’s environment.
The Gentlemen runs an onion site for leaking data of victims who refuse to pay a ransom. Ransom negotiations happen through each affiliate’s own Tox ID (peer-to-peer instant messaging protocol).
Technical characteristics The Gentlemen ransomware is written in the Go programming language, with multi-OS lockers available for affiliates (a Go-based locker covering Windows, Linux, Network Attached Storage, and Berkeley Software Distribution, plus a separate C-based locker for ESXi hypervisors). Microsoft has described the encryptor as self-propagating.
The group usually gains its first foothold through internet-facing edge devices like VPNs (virtual private networks) and firewalls (especially Fortinet FortiGate and Cisco), using a mix of password brute-forcing, exploiting known unpatched vulnerabilities, buying ready-made access from brokers, and hunting for reusable credentials in data-breach search engines, then uses that foothold as a pivot to move deeper into the network.
Once inside, the attackers map the network and escalate their privileges toward domain administrator access (using Active Directory discovery, certificate abuse, and local exploits) while simultaneously trying to bypass or disable defenses like EDR (endpoint detection and response) tools and antivirus through misconfigurations, registry and log tampering, and BYOVD (bring-your-own-vulnerable-driver) techniques that overwrite security software.
The Gentlemen then spreads across the network, sets up hidden backup connections, steals credentials and active browser sessions, exfiltrates data, and deploys their custom locker to encrypt everything at once.
Targets and reported scale The Gentlemen has claimed over 400 victims across more than 70 countries since the group first appeared.
Most of the group's claimed victims appeared in early 2026, and its claimed volume during that period was second to Qilin and ahead of groups such as Cl0p, RansomHub, and LockBit. These figures come from the group's own leak-site claims and have not been independently verified.
Affected sectors included manufacturing, technology, construction, energy and utilities, healthcare, insurance, education, transportation, and financial services industries. Geographically, The Gentlemen has targeted organizations in APAC, Europe, Latin America, the United States, Canada, the Middle East, and Africa.
Public exposure In May 2026, The Gentlemen’s internal Rocket.Chat communications infrastructure was breached, and an archive of its data, spanning November 2025 to late April 2026, was offered for sale on 5 May before being released freely on several cybercrime forums on 8 May, exposing detailed information about the group's structure, tooling, victim targeting, and negotiation tactics.
After the leak, the group's administrator announced a complete rebuild of its communication infrastructure, new storage systems, and upgrades to the locker.
References