Lider Aviacao Data Breach

Thegentlemen ransomware operation targeted Lider Aviacao, a Brazilian aviation services company, with its services listed on the group’s leak site on September 5, 2026. This listing was identified by SOCRadar’s Dark Web Monitoring service. As a provider of charter flights and related services, Lider Aviacao represents the ransomware group’s most recent target in Latin America and expands their reach into the Brazilian aviation sector. The nature of aviation companies, which handle sensitive operational data, passenger records, and flight information, makes them particularly attractive targets due to the high potential impact of data exfiltration and disruption. Thegentlemen has been exceptionally active recently, claiming 237 victims in the last 60 days. Their primary targets are organizations within the Manufacturing and Technology sectors, with a significant presence in the United States, United Kingdom, and India. Lider Aviacao’s inclusion aligns with the group’s broader pattern of targeting the transportation industry. Previous victims in this sector include Servicios Aereos Estrella, Meridian Logistics Group, Oceanica Internacional, and Roadvision Systems. The targeting of an aviation company like Lider Aviacao is notable, as it involves critical infrastructure and higher stakes data compared to more general logistics operations, making this listing a significant development beyond typical ransomware activity.

SOCRadar’s investigation involved a stealer-log query specifically targeting the domain lideraviacao[.]com.br. The query returned no records, indicating no direct correlation was found within the analyzed dataset. However, it is crucial to understand the limitations of this finding. The query is bounded, meaning that any potential credential exposure could exist under alternate corporate domains or through personal email aliases that were not included in this specific search. Therefore, the absence of positive signals from this query does not definitively confirm that the organization is unaffected by credential compromise. For thegentlemen ransomware operations, harvested credentials are a primary vector for initial access. These compromised logins are typically validated and exploited to gain access to remote-access portals before ransomware deployment. Consequently, a null result from a credential telemetry query does not rule out this intrusion scenario. Organizations should consider the possibility of credential exposure through other channels or at different times, especially given the nature of infostealer malware and its role in facilitating ransomware attacks. Given the potential for credential compromise and the known tactics of thegentlemen, continued monitoring for any new listings or evidence of compromise is recommended. Proactive measures such as regular credential hygiene checks, password rotation, and a thorough review of multi-factor authentication settings across all accessible portals, including Microsoft 365, VPNs, and other remote-access solutions, are essential to mitigate risks. Monitoring for activity on alternate corporate domains may also reveal previously undetected exposures.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.