Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
thegentlemen Ransomware Group
Ransomware group profile
1,045Victims
RussiaSource country
107Impact score
Also Known As
The Gentlemen Ransomware
the gentlemen
Description
The Gentlemen is a financially motivated ransomware-as-a-service group that emerged in early 2023 and gained significant prominence by 2025. They utilize a double-extortion model, encrypting data while threatening to leak sensitive information, often accelerating pressure tactics without extensive negotiations.
Key insights
- •Targets primarily sectors like healthcare, technology, and construction, avoiding Commonwealth of Independent States entities.
- •Initial access often gained through exploitation of CVE-2024-55591 in FortiOS and FortiProxy devices.
- •Employs advanced tactics including BYOVD attacks for evasion and a pre-ransomware script to disable security measures.
- •Maintains a database of compromised credentials to enhance targeting and operational effectiveness.
- •Demonstrates a preference for rapid data publication to maximize pressure on victims.
Threat Level & Status Breakdown
For thegentlemen · Based on incidents in selected period
4.6threat level
Aggressiveness10/ 10
Lethality0/ 10
Criticality3.6/ 10
Status Breakdown
Data Leaked0.4%4
Negotiating0.2%2
Claimed99.4%1,039
First seenOct 2025
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 27, 2026
Recent activity
Monthly attack count for thegentlemen in the selected period
1,045Total attacks
162peak in Aug
80.4avg / month
↑ 133 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for thegentlemen
- 21ee713585ed802b675b7144f7ebd875573e09809c2dff21e65da3d127fdca71
- 0cb89b37239f94d214c12419addf49e3143ae71e53fe1934fa5776c8eafd9c51
- 48868c98dfabd703031587cffdbe5ca26ac180a15e89a52e59915710f1836f28
- 5f41cf47e7dbfe9d4290d64877c2db7fc9509fc15ce1e5ccda66cadefcbcb9fe
- ae593146b2cd736b65d71386caa86669577527bd1574b4e4beb9539b566f1190
- c11d57472a70943367581b31d8732b29885470741b8aed1c7692956d9666eb91
- e2b5fc7e457661fb886e8bac99d15b0cba3871fc72950ca4802aa6f0c4494553
- bef87021caf35bf50370c0a11ccf83de14cbc1558380b690a63f87f1bf4cb366
- 8bba473887e6d31f60d13c4fdc903bfbf688f912ad8aa5ea171ae626d3a7b9a4
- d4ae978d0fa31d31144a0289f2307393deb992a54e4e7335e923511ac6bbc47e
- 27d39120cdc08ce2ae074abcdde208d533aa8f3f6569c0c182600f3abfd96851
- 7114be5cb487e2975d2167a8660f164a3b2ec8dc1323b0f7919c5013fb5027de
- e26df3b6bc8c55f7d07d178707f173e6a3881016eb3644498e162f0dc97da92d
- 4bb026581df62b024c8e3a15d0e52ff8d45124695c6e71ea14756abec409b15e
- ba3689bf7bc6f8d8468dde5c36df56163b40d0ddfc1991e35dde258cd25428b2
- 9113fcddc88f6eb5d38910e5bee2ce95736c9ad7a27984c1ce136790325d0382
- 2d49a9e3e31062a711b4027f834554f8bce5f479e01df5315d237903181b351d
- 29f87d32b658cba4093f0b90257404c262bc1d5a65de28ba6ad4ffdf4f65fe6e
- 90fe2b57f37d6bd045d22841fd192fccf4233bf8b21d85e5e927b68b0157b8f2
- d91e304a337858f2dcfbf1e6a366f95320fb0400022a4326487b648b9898a36d
- fc0269ad99451a97de8348efbdb248a5ba341d3684952bc448ec62817537252d
- f377698712265c87ceba162f0c33a26b86d23724a2613c637dd9af8b11c21da6
- cd56540cd8689a6874aeeed76841456c08d6afdaf3034598e60cf620f0ae0591
- 19bd1314e268493503c5570a5dda6b55eac3aac6608ec16257874bd799b285d8
- 477b2dd5a1d23713d56fcc976932b3ef0620b1b63f91cc0fde5a3587e2954981
- ad03ef341dfc36fbe7f74392b5619293894ee9554a164ec277d66dd21b780a2d
- ec511c74666b6e537725a1238a2429ab95d2b2ab01a5456d5d04a03f2a062649
- f6fbe16811654ff1fb44d939bd989f3d1eac5e28f986157030cb9bf3da290c60
- 0fcd7c4f78648a396eda077072706ceab6dee00e8ea22a7ff35a01740d0af805
- 609aa250c4b5ac9457f41f9dcfe63f983886fa7cd120e188538ebe247244ade1
- 22d4777f8a1da4131b37cbc3d5eb60dbae2a1c3db2d658d17a91ef67d3378622
- ad53d8cb65833146fc6740be5dd6938fe90d94256e428468dfd508c80346d511
- 2f2b21bc394589466cfdc813aad597347892cc9a43a3742808adc7ce44c907bb
- f55ad6ac989ab71a393c9d038f5cec473fe8ebd00197966b7051d493c53b59c8
- 74b35f75ad33504cb9e61ba7061d2425dae3870fc5230cf265f7d2ceef1911f2
- 8795abe52d8d274a2ae11fbc7df36809c810333fda63e64da495aa3278321350
- 11942f525df4f7681006b3e681656ef32e3afd248e2d51d3660a80b958f4947e
- 118c38f1051be7f51c34044429bc06d0eca114c0196b7b7482221c7add2063c6
- 293b1dc6e080ae3eac1de84ea384671c44cdf1d03fe51e5110749f8f358cbd64
- 129f838cc7d6a60993aa1e622aa56b748fb511b9578d35c7da200e837c7cc291
- 839cceb4d34eae502cac95ce4459c5080d8a42f8c3b9dcb6e51af4ff565e4c2e
- bda528cc5bbd85a350ae5329f9c87ca6a8eca5bf2e8579d878636de5ab99f2da
- 0a27d422d8ab0e1cc58258e431a83834239fec7285146b62e5de9b11cd3b3e9e
- 09c028c2289a401b45210b75f720ccad711216c756bce5ac04fb79620a91aee0
- adefbec6608c664c793d37e0a41a36ab19af1a5ba9e81e89e76252b49cfeb361
- be3bc809131c283b8deb542e11ed0878468b8db531696fdbee03978fde55be0e
- b15dcba2635f3329822d030c98a6dd92d7e6a19941797257e7e6a583dfa54efc
- 4feb0b3c0fc8a7347395d85cc11d57e8f2d585ccfd0836e65525a83e244cc883
- 12fe4665c093505b17a1b6807d8c508bc71a2d43ff9b9ffdf712ec4345e25866
- 6a7a89d1573d28a5803a4f4d18a08aa75a7136328ccd60df42e1d524d7886877
- 1884ea40e0f30433b31bfae38391aae4e632422fd895bb6d0ee79256e6259d81
- 0c9ce8e07011b5afd00ae5cdebeca156c5cc606c2d5820a03d8c0a89f2d7c0fa
- ea0b2f4ba9611770b640cfffe78fc60c5158d11cc32d235b966ec4a91c168ff4
- a5c6a4ffe798d6a23e8ec1532c04df2eb7a365a4f68c2b0dd1f48eadc6d31b04
- e9ad2f3a267741db5bbd7e687b7129eccd479c674fca19e2419b868f6b1e449a
- e9285e5adc7bded1b4883e4f16cec6ea332d73d9f495f807229222fbac1dd2ce
- 8148ab6928e472a7748348ed1b7e2e9ff572cd74ecd6cc68d74ea354475e10ab
- dc6f7a16016a2437a9711f8e734021d4a10e61b3c60cb8b09d805d75c8969336
- 253d02cfe9f5c222ae1544c6e57900093de6fd01162d6584f52e2833174fdc24
- 57f7a66f829e6ff154a93171100252157fe3ff0cc136dfa33fe3329f087a7eb8
- fbb85ddbd561784840349cbcf306771a6ffc698bd6955a3de1338d92d1670d11
- 2013668a450713b24fdfb34ec2488b7893bc01836879f9b1c0f739d5deee573a
- 90d14626e53c4391401e09607d758635348f3ce93f52d337741e95f60f36c720
- ffd41695457a2fc2abe85c553553f3ac0603cf2669604b5733120b794adbd818
- 6fc6b7a65481e9351a92b85b6ce041b7f6d3ffb1f7833748f0cb80b296ba6e41
- 4cde84a979fc9c967a3886fba6feeddf5c1ea7cb708762f1ea5ecd4d3cda62cc
- 09ac4a095622cc699022c5ecb83234df2b7dbf3035f1dc6fb439dc1e0059a480
- c4f5e0b453347dee387a91d0da2c4db65b8106dfe3511a6fcd6f79756b031096
- 3580879264f6639e965c8df100501fe1878c38321d9115895ab6ad2410539e9b
- bc906faf69697803a7b652ea2196bda2ab7667587fb7c39a257b6a16cf72dccf
- 3d987e833b8dc2b4871ab1dcb8719a4159ab11d8d28b884ad84236688b428151
- c0109510d5dc388e31211f0fd9a4f90bbf3420945775ffed6f18b1e9693e3555
- ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918
- ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb
- ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e
- c20411a88faf07c7f4029c679d89be3b7140cf117a4c099f127000d799fbb418
- 14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212
- 0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5
- ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4
- 41d056e80567216c565ab5796c9bd4e4b7a56fd14a8f99c044ea0206c079be76
- 4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a
- e02ae43c682eb8a969b0b667d8562274762044930686389bc0539ed0f58dd0f1
- 1e9d18d242e3eb9165dde2704a9164e2520813c50467d16b444a738b49cfb4e9
- 413a6a2294dd1e2839364e1c43354d1b3effd047e3f051b94f8e3a9d8738ad72
- 40955ab5c1307aac6c2f5074dce860e8a9e120d9b57beeb27aa4d389f9d484df
- 7dc1e88b946583e7fb47a1d5797eda8e9043ed8840337d4ea00cd9414ad7532e
- 230c3debc5c42fad37ac8ffa2f9ce84a7694ccb20f5a92963c345bc434e3b0f7
- 9afa980905b73ca88f387bbb795341d3666530000447f36bdcb8502bf50470be
- 8d6761f6824176848db7297a3e98694b32215dc44ec6be5780d877639b05bb37
- c42a476182f22a2571711d3ad173884e9d394e00bc777011d01998573626f88d
- 9a5020855a37a861898bcc15c7bba0f1498a85104fc97a59bbcd31f26b7b2e68
- 29009de86551267b66080bcf4bb97609e09e383eb05b63c8f91aab5bbe30894c
- 190178582dd9876ca6f8fd012deb9e0739c6040e68f858202d8dc4d513a6afe7
- 7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20
- 40d03f68520be536eaf020b60ac9d3937b0abfba833f2926f7f005f14860d376
- 91218ee352ba3942fc358e49b84bdb1aea26e8b0885fce82d5d8bba4dc71c16a
- 1d2bf492f606d7469e6895c52d763406c1bb0e36435d1f323ce5cdb2889d3efc
- b05c73ef9731d2087fdae483350a9d08e58e4bc4ec84062d7ae3efc87982ea37
- 7c0e0b139e8b6a4dfb6aae8121dec5c88e90481ed1de7f273f6f36726409e26a
- 67360b25498795a7dab3e15c74b5814987a991c08457ce1ec3baf0de95f81c82
- 995c64d437288c1d1f9403e5cbb98b33b736df00515e5cf73dfdf18fe731fb49
- dfb0482d39b66bcb62f794631f39971993da18da4d6c92817c3335f1711b1dd3
- 6244ffbbcb71729d31d1099b60545815a286062eb2ee2b00be07d6f05e4dc721
- 51745597945a0966846bb97ae18524649e1f759268b949d8aeaea4a53a9a1b96
- c26520e6e7f31183418a05793ee0d2a63e19578997176c130a5791f1cc2d72a7
- 0120990444ff05bbbe7d31f874319b23d43e2376052840e7f42696c69638206c
- 70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82
- 612689acd0dee5373e7b6020069b55a3e031218942be20367ee342420357cad4
- 935ee232fe107c1b452abaa2a3e7290b7b0021b0399cc038df7d298030bb638a
- f9657e6ce75007f96c25bf78fd1808c0e5f7478c55ce7f976aa76765cb46443f
- 31d11693da0c7ae79e8a5ec8ca6e59bf6141ac1bff82a986d120de021e140fd8
- 8f7fa78a7244ad95a1deee10bc8a30250dbdc6a4e94562d174737151d1533dc0
- cf1f4e50e28a697123dcabdc31514ae2dc058bfba762e7c10b5bc71f9adf443a
- 53b99df3805f084ba95710955746fe4e4ff410983b15bc7a574a60d6976629a9
- fda97b7e922b4cc08a77d6eda4ccabcbc1cfd8a5459166e4c1d0c4aeafef9678
- 6565bcda727664399cca345aae74de387aefd9f416b05ef1153ee5f16cf8c586
- 26eb4e606d4a18f15b7c03bd0f479101727bdf550db0c5d71325d889a986c58b
- e7c546134a20c98eddf47f85f661fc304e932d536781ddc35d52962762d402f5
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for thegentlemen
CVE-2026-79994
CVE-2026-77179
CVE-2026-63030
CVE-2026-49994
CVE-2026-41940
CVE-2026-41089
CVE-2026-35616
CVE-2026-21589
CVE-2026-15409
CVE-2026-0300
CVE-2025-7771
CVE-2025-70795
CVE-2025-59718
CVE-2025-33073
CVE-2025-32433
CVE-2025-24799
CVE-2024-57727
CVE-2024-55591
CVE-2024-4947
CVE-2024-37085
CVE-2023-39831
CVE-2023-38831
CVE-2023-36884
CVE-2023-27532
CVE-2022-30190
CVE-2021-1675
CVE-2020-1472
CVE-2018-0798
Other
T1486
T1486
T1490
T1490
T1078
T1078
T1068
T1068
T1059
T1059
T1562
T1562
T1021
T1021
T1021.001
T1021.001
T1047
T1047
T1218
T1218
T1550
T1550
T1555
T1555
Victims(200)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| First Dental | — | Claimed | about 2 hours ago | |
| Bi Link | — | Claimed | about 10 hours ago | |
| FPT Software | — | Claimed | about 24 hours ago | |
| Eichstatt | — | Claimed | 1 day ago | |
| Regency Park Oak Knoll | — | Claimed | 1 day ago | |
| ImmoVia Hausverwaltung | — | Claimed | 1 day ago | |
| Mercantile Investment Corporation Bolivia S A | — | Claimed | 1 day ago | |
| SuperScale | — | Claimed | 1 day ago | |
| Rexville Radiology | — | Claimed | 1 day ago | |
| Grundbaulabor Trier | — | Claimed | 1 day ago | |
| Mann Group | — | Claimed | 1 day ago | |
| SAP | — | Claimed | 1 day ago | |
| Groupe AC Environnement | — | Claimed | 1 day ago | |
| Trade Union Co | — | Claimed | 1 day ago | |
| SOME | — | Claimed | 1 day ago | |
| WABAG | — | Claimed | 1 day ago | |
| Lydenburg Toyota | — | Claimed | 1 day ago | |
| Unisa Shoes | — | Claimed | 1 day ago | |
| Zinkan Enterprises | — | Claimed | 1 day ago | |
| Malmsten | — | Claimed | 1 day ago |
Claimed
about 2 hours agoClaimed
about 10 hours agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoClaimed
1 day agoPage 1 of 10
Affected countries(115)
Countries where this group has been reported to target or leak victims.
🇦🇩Andorra🇦🇪United Arab Emirates🇦🇬Antigua and Barbuda🇦🇴Angola🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇧Barbados🇧🇩Bangladesh🇧🇪Belgium🇧🇬BulgariaBolivia, Plurinational State of🇧🇷Brazil🇧🇿Belize🇨🇦Canada🇨🇭SwitzerlandCôte d'Ivoire🇨🇱Chile🇨🇳China🇨🇴Colombia🇨🇷Costa Rica🇨🇾Cyprus🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇩🇿Algeria🇪🇨Ecuador🇪🇬Egypt🇪🇸Spain🇪🇹Ethiopia🇫🇮Finland🇫🇯Fiji🇫🇷France🇬🇧United KingdomFrench GuianaGuernsey🇬🇭Ghana🇬🇲GambiaGuadeloupe🇬🇷Greece🇬🇹Guatemala🇬🇾Guyana🇭🇰Hong Kong🇭🇳Honduras🇭🇷Croatia🇭🇹Haiti🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳India🇮🇶Iraq🇮🇸Iceland🇮🇹Italy🇯🇲Jamaica🇯🇴Jordan🇯🇵Japan🇰🇪KenyaKorea, Republic of🇰🇼Kuwait🇰🇿KazakhstanLao People's Democratic Republic🇱🇧Lebanon🇱🇨Saint Lucia🇱🇺Luxembourg🇲🇦Morocco🇲🇨MonacoMoldova, Republic of🇲🇬MadagascarMacedonia, the Former Yugoslav Republic of🇲🇹Malta🇲🇺Mauritius🇲🇽Mexico🇲🇾Malaysia🇳🇬Nigeria🇳🇮Nicaragua🇳🇱Netherlands🇳🇴Norway🇳🇵Nepal🇳🇿New Zealand🇴🇲Oman🇵🇦Panama🇵🇪Peru🇵🇬Papua New Guinea🇵🇭Philippines🇵🇰Pakistan🇵🇱PolandPuerto Rico🇵🇹Portugal🇵🇾Paraguay🇶🇦Qatar🇷🇴Romania🇷🇸SerbiaRussian Federation🇸🇦Saudi Arabia🇸🇨Seychelles🇸🇪Sweden🇸🇬Singapore🇸🇰Slovakia🇸🇳Senegal🇸🇻El Salvador🇹🇭Thailand🇹🇳Tunisia🇹🇷Turkey🇹🇹Trinidad and TobagoTaiwan, Province of ChinaTanzania, United Republic of🇺🇦Ukraine🇺🇸United States🇺🇾UruguayVenezuela, Bolivarian Republic of🇻🇳Vietnam🇼🇸Samoa🇿🇦South Africa