File · The Gentlemen · Crime · refreshed 2026-10-18
attack rose · 17 techniques across 7 tactics
Last 30 days
last seen yesterday- seen against
- United States · Canada · United Kingdom · Brazil · Australia
- sectors
- Manufacturing · Healthcare · Technology · Other · Professional Services
What changed
ledger · newest first- —1 mo agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption methods based on file size. The group targets medium to large organizations across various sectors, particularly in the Asia-Pacific region, and has demonstrated a high level of technical maturity and operational discipline. Their activities include systematic compromise of enterprise environments, mass account enumeration, and the use of encrypted channels for data exfiltration.
Observed targets (as stated by the sources)
55 countries · 14 sectorsassessed originnot stated by sourcesobserved targets · 55
countries · 55
- United States
- United Kingdom
- Brazil
- Italy
- Canada
- India
- Germany
- Taiwan
- Mexico
- Thailand
- Australia
- South Africa
- Japan
- France
- Argentina
- Chile
- Spain
- Switzerland
- Austria
- Sweden
- Czechia
- South Korea
- Israel
- Vietnam
- +31
sectors · 14
- Manufacturing
- Healthcare
- Technology
- Other
- Not Found
- Professional Services
- Retail & E-Commerce
- Education
- Financial Services
- Agriculture and Food Production
- Energy & Utilities
- Government & Defense
- Hospitality
- Transportation
also stated: Belize, PR, Andorra, Antigua and Barbuda, Samoa
as stated by the cited sources, not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique17 techniques · 7 of 15 tactics
Resource development
6 techniquesInitial access
1 techniquePrivilege escalation
1 techniqueStealth
5 techniquesDiscovery
1 techniqueCommand and control
1 techniqueImpact
2 techniques
select a technique
Arsenal
1 malware · 2 tools| Malware · 1 | ATT&CK |
|---|---|
| The Gentlemen Ransomware | S9051 ↗ |
as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Victims
leak-site listings| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 307 | ≈ 27.9 / month | above the lifetime rate 266 |
- Victims observed
- 307
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 27.9 / month
- Last 30 days
- above the lifetime rate 266
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
Take it with you
keyless · no signupReferences
11 sources- 1.socradar.io/blog/dark-web-profile-the-gentlemen-ransomware
- 2.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware…
- 3.cybereason.com/blog/the-gentlemen-ransomware
- 4.sprocketsecurity.com/blog/tracing-a-threat-actors-footprints-on-tor
- 5.attack.mitre.org/groups/G1058
- 6.unit42.paloaltonetworks.com/the-gentlemen-ransomware
- 7.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps
- 8.research.checkpoint.com/2026/dfir-report-the-gentlemen
- 9.intel471.com/blog/threat-hunting-case-study-the-gentlemen
- 10.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomwar…
- +1 more in the JSON record
Track The Gentlemen on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.