the gentlemen Ransomware Group
Ransomware group profile
Description
The Gentlemen is a financially motivated ransomware-as-a-service group that emerged in early 2023 and gained significant prominence by 2025. They utilize a double-extortion model, encrypting data while threatening to leak sensitive information, often accelerating pressure tactics without extensive negotiations.
Key insights
- •Targets primarily sectors like healthcare, technology, and construction, avoiding Commonwealth of Independent States entities.
- •Initial access often gained through exploitation of CVE-2024-55591 in FortiOS and FortiProxy devices.
- •Employs advanced tactics including BYOVD attacks for evasion and a pre-ransomware script to disable security measures.
- •Maintains a database of compromised credentials to enhance targeting and operational effectiveness.
- •Demonstrates a preference for rapid data publication to maximize pressure on victims.
Threat Level & Status Breakdown
For the gentlemen · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for the gentlemen in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for the gentlemen
- 7e366683f1d175278feefaaa35d87e87076931974506b9f373a775a428c28f10
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for the gentlemen
T1486
T1486
T1490
T1490
T1078
T1078
T1068
T1068
T1059
T1059
T1562
T1562
T1021
T1021
T1021.001
T1021.001
T1047
T1047
T1218
T1218
T1550
T1550
T1555
T1555
Victims(200)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Advanced Marketing | Mexico | Unknown | 10 days ago | |
| Wunschkind Klinik Dr Brunbauer | Austria | Unknown | 11 days ago | |
| vpcgroup.com customfoam.com | United States | Unknown | 11 days ago | |
| Herbahaz | Hungary | Unknown | 11 days ago | |
| Gloria Maris Groupe | France | Unknown | 11 days ago | |
| HBS Group | Australia | Unknown | 11 days ago | |
| Henry Frerk Sons | United States | Unknown | 11 days ago | |
| Decoupe Laser Services | France | Unknown | 11 days ago | |
| Title Resources | Australia | Unknown | 11 days ago | |
| Clarke Radiology | Australia | Unknown | 11 days ago | |
| SICSOE | France | Unknown | 11 days ago | |
| TC Printing | Australia | Unknown | 11 days ago | |
| Oldelval Oleoductos del Valle | Argentina | Unknown | 11 days ago | |
| European Design | Canada | Unknown | 11 days ago | |
| Disney Family | United States | Data Leaked | 11 days ago | |
| Ecopetrol | Colombia | Negotiating | 16 days ago | |
| Advantage Home Health Care | United States | Unknown | 17 days ago | |
| Mesto Celakovice | Czech Republic | Unknown | 18 days ago | |
| Tooltec | Sweden | Unknown | 18 days ago | |
| Terra Vitis | France | Unknown | 18 days ago |
Page 1 of 10
Affected countries(97)
Countries where this group has been reported to target or leak victims.