Zelham Data Breach

Zelham was listed on The Gentlemen ransomware group’s dark web leak site on October 3, 2026. The group alleges that they breached Zelham’s systems and exfiltrated sensitive corporate data. This listing indicates a double extortion tactic, where the stolen data may be published if ransom negotiations are unsuccessful. This operational consequence exists independently of whether data encryption actually occurred. The Gentlemen have maintained an aggressive operational tempo over the past 60 days, utilizing an affiliate structure to conduct parallel intrusion campaigns. Their targets include both small and medium-sized enterprises (SMEs) and larger organizations. Affiliates commonly leverage credentials obtained from infostealer malware for initial access, followed by systematic lateral movement before deploying their ransomware payload. The Gentlemen operate a Ransomware-as-a-Service (RaaS) model, providing affiliates with the necessary infrastructure and negotiation services, while the affiliates are responsible for gaining access to the victim’s network.

SOCRadar’s stealer-log intelligence did not surface any corroborated credential records directly tied to Zelham’s known infrastructure. However, this absence of evidence does not definitively rule out credential-based initial access. It is possible that staff credentials may exist within stealer datasets under domains not yet correlated with Zelham’s known infrastructure. Alternatively, initial access could have been achieved through other methods such as phishing campaigns or the exploitation of a public-facing application, which would bypass the stealer-log signal entirely. Given these potential pathways, Zelham should immediately engage incident response specialists to thoroughly assess the scope of the intrusion and any potential data exfiltration. It is critical to enforce multi-factor authentication (MFA) on all remote access systems, deploy Endpoint Detection and Response (EDR) solutions across all endpoints, and meticulously review external access pathways for any signs of unauthorized activity or sessions. Furthermore, confirming the integrity and modification status of offline backups is paramount.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.