File · thegentlemen · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
thegentlemen
- Storm-2697
sigil · no ATT&CK coverage stated
Last 30 days
last seen today- seen against
- United States · United Kingdom · Mexico · South Africa · Austria
- sectors
- Manufacturing · Healthcare · Technology · Other · Professional Services
What changed
ledger · newest first- —17 d agovictimsvictim count 308 → 328 (+20)
- —24 d agovictimsvictim count 307 → 308 (+1)
- —1 mo agovictimsvictim count 275 → 307 (+32)
- —1 mo agovictimsvictim count 256 → 275 (+19)
Analyst brief
ransomware.liveThe Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Observed targets (as stated by the sources)
50 countries · 14 sectorsassessed originnot stated by sourcesobserved targets · 50
countries · 50
- United States
- United Kingdom
- Italy
- Brazil
- Mexico
- Germany
- India
- Canada
- Taiwan
- South Africa
- Japan
- Chile
- Australia
- Austria
- Sweden
- Argentina
- Spain
- Vietnam
- Greece
- France
- Singapore
- Portugal
- Thailand
- Switzerland
- +26
sectors · 14
- Manufacturing
- Technology
- Not Found
- Other
- Healthcare
- Professional Services
- Retail & E-Commerce
- Agriculture and Food Production
- Financial Services
- Education
- Energy & Utilities
- Transportation
- Hospitality
- Government & Defense
also stated: PR, Belize, Antigua and Barbuda, Samoa
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate | Last 30 days |
|---|---|---|---|---|
| 227 | ≈ 56.8 / month | above the lifetime rate 60 |
- Victims observed
- 227
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 56.8 / month
- Last 30 days
- above the lifetime rate 60
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack thegentlemen on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.