Grupolider Data Breach

The ransomware group TheGentlemen has listed Grupolider, a commercial business group operating in Angola, on its dark web portal on September 21, 2026. SOCRadar’s Dark Web Monitoring service identified this listing. Grupolider operates across multiple commercial sectors within Angola. This geographic focus is unusual for TheGentlemen, as its 215 claimed victims over the past 60 days are predominantly located in the United States, the United Kingdom, and Brazil. The group’s typical targeting leans towards North Atlantic markets, making Grupolider a notable outlier in terms of location. TheGentlemen has been highly active, claiming 215 victims in the last 60 days. Their primary focus lies in the Manufacturing, Technology, and Other sectors. Recent victims claimed by the group include Humboldt, Gelarti, Alchin Long Group, and Soni Dwarkadas Virchand. While Grupolider’s presence in sub-Saharan Africa deviates from TheGentlemen’s established victimology, the profile of Grupolider as a mid-market commercial entity aligns with the group’s general targeting patterns.

SOCRadar’s analysis of stealer-log data revealed 26 records associated with the domain `grupolider-ao[.]com`. These records, collected between August 19 and September 18, 2026, include 18 classified as employee credentials on organization-owned systems. Specific findings include six records related to Google identity infrastructure with corporate-domain usernames, indications of internal LAN IP addresses accessed with corporate credentials, a hosting control panel accessible via a cPanel port, and a RealVNC remote desktop service accessed via a corporate account. One corporate username appeared across 11 records over a five-week period, indicating diverse internal and external service access. This pattern of credential exposure, particularly the single compromised workstation signal evident in the 11 records tied to one username over five weeks, is consistent with a persistent infostealer infection that may not have been detected or contained. The observed exposures of RealVNC and cPanel suggest that an adversary with this access could potentially move laterally into servers and backup systems. The timeline of data harvesting ending on September 18, followed by the leak-site listing on September 21, indicates that TheGentlemen may have acted upon recently validated credentials. Immediate actions recommended include rotating all credentials for the identified account, revoking Google Workspace sessions, auditing RealVNC access logs, and assessing the integrity of cPanel-managed servers.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.