Ransomware needs a way in. Stolen credentials are the cheapest one.
thegentlemen Ransomware Group
Ransomware group profile
Description
The Gentlemen is a financially motivated ransomware-as-a-service group that emerged in early 2023 and gained significant prominence by 2025. They utilize a double-extortion model, encrypting data while threatening to leak sensitive information, often accelerating pressure tactics without extensive negotiations.
Key insights
- •Targets primarily sectors like healthcare, technology, and construction, avoiding Commonwealth of Independent States entities.
- •Initial access often gained through exploitation of CVE-2024-55591 in FortiOS and FortiProxy devices.
- •Employs advanced tactics including BYOVD attacks for evasion and a pre-ransomware script to disable security measures.
- •Maintains a database of compromised credentials to enhance targeting and operational effectiveness.
- •Demonstrates a preference for rapid data publication to maximize pressure on victims.
Threat Level & Status Breakdown
For thegentlemen · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for thegentlemen in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for thegentlemen
- 7e366683f1d175278feefaaa35d87e87076931974506b9f373a775a428c28f10
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for thegentlemen
T1486
T1486
T1490
T1490
T1078
T1078
T1068
T1068
T1059
T1059
T1562
T1562
T1021
T1021
T1021.001
T1021.001
T1047
T1047
T1218
T1218
T1550
T1550
T1555
T1555
Victims(200)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| TENTAC Co., Ltd | Japan | Claimed | 4 days ago | |
| MedSkin Solutions Dr. Suwelack AG | Germany | Claimed | 4 days ago | |
| Vittoria Assicurazioni | Italy | Claimed | 4 days ago | |
| TMI Tecnicas Mecanicas Ilerdenses | Spain | Claimed | 4 days ago | |
| Sarku Japan | Japan | Claimed | 4 days ago | |
| Librería Santa Fe | Argentina | Claimed | 4 days ago | |
| Apteki Mareshki | Bulgaria | Claimed | 4 days ago | |
| Aforpa | France | Claimed | 4 days ago | |
| Wada Farms | United States | Claimed | 4 days ago | |
| Somit | Guatemala | Claimed | 4 days ago | |
| Multipla Contabilidade Empresarial | Brazil | Claimed | 4 days ago | |
| Technical Asia | Thailand | Claimed | 4 days ago | |
| Ardom Eilot | Israel | Claimed | 4 days ago | |
| BGR Energy Systems Limited | India | Claimed | 4 days ago | |
| Dang Invest Group | Czech Republic | Claimed | 4 days ago | |
| Dome Gold Mines | Australia | Claimed | 4 days ago | |
| High Oakham Primary School | United Kingdom | Claimed | 4 days ago | |
| Humboldt | Brazil | Claimed | 4 days ago | |
| Iveta | Croatia | Claimed | 4 days ago | |
| Neff & Drexel AG | Switzerland | Claimed | 4 days ago |
Page 1 of 10
Affected countries(105)
Countries where this group has been reported to target or leak victims.