In the summer of 2025, almost nobody outside a few threat intelligence teams had heard of The Gentlemen. A year later it was the second most active ransomware operation in the world, behind only Qilin, with hundreds of victims across dozens of countries.
Few ransomware brands have grown that fast, and the reasons say a lot about how the criminal economy works today: an experienced founder who learned the trade inside another gang, an unusually generous deal for affiliates, heavy use of stolen credentials and unpatched firewalls, and even AI coding tools to speed up development. This guide covers what defenders need to know about The Gentlemen and the dark web signals that tend to appear before its attacks.
What Is The Gentlemen Ransomware?
The Gentlemen is a ransomware-as-a-service (RaaS) operation that uses double extortion: affiliates steal data, encrypt systems, and threaten to publish the stolen files on the group's leak site if the victim does not pay. Microsoft tracks the group as Storm-2697, and the threat intelligence firm PRODAFT calls it Phantom Mantis.
Like other RaaS brands, it splits the work. A small core team writes the ransomware, runs the affiliate panel and leak site, and handles payouts. Affiliates find and break into victims. The group operates inside the Russian-speaking cybercrime world and reportedly avoids targets in the Commonwealth of Independent States.
From Qilin Affiliate to Rival Brand
The Gentlemen did not start from scratch. Researchers trace its roots to an affiliate team known as ArmCorp, which worked under the Qilin ransomware program in early 2025. Barracuda reports that in July 2025 an ArmCorp operator publicly accused Qilin's administrators of withholding roughly $48,000 in payouts. Shortly afterwards the team went independent.
Coming out of Qilin gave the founders two advantages: proven intrusion skills and a network of affiliates who already knew them. The administrator, known by the handle zeta88 according to Check Point, still personally takes part in attacks.
How Fast The Gentlemen Has Grown
The numbers below come from different trackers at different dates, but the trend is clear.
- April 2026: more than 320 public victims since mid-2025, 240 of them in 2026 alone (Check Point Research).
- July 2026: 580 claimed victims across 77 countries. Victims in the first half of 2026 were slightly more than six times the number in the second half of 2025 (Unit 42).
- August 2026: more than 750 claimed victims worldwide (Barracuda).
The public count may understate the real total. During an incident response engagement, Check Point Research accessed an affiliate's command-and-control server and found a botnet pointing to more than 1,570 likely corporate victims, far more than the group had listed on its leak site.
Why affiliates joined so quickly
Money. The Gentlemen offers affiliates a 90/10 split, keeping only 10 percent for the core team. Most RaaS programs keep 20 to 30 percent. For an experienced affiliate, moving to The Gentlemen meant a larger cut of every payment, and Check Point notes that several former Qilin affiliates made the switch.
How Gentlemen Affiliates Get In
1. Exploiting firewalls and VPNs
The most documented entry point is unpatched edge devices. Researchers repeatedly cite CVE-2024-55591, an authentication bypass in Fortinet FortiGate firewalls, and CVE-2025-32433, a flaw in the Erlang/OTP SSH server. In the first case Trend Micro analysed, attackers most likely came in through an internet-facing FortiGate after compromising an administrator account.
2. Stolen and purchased credentials
Affiliates use VPN credentials, configuration files and logins taken from infostealer logs, and they share access material with each other. Barracuda also notes interest in Outlook Web App, Okta and compromised email accounts, which give a foothold in cloud services as well as the internal network.
3. Brute force and access brokers
Where no credentials are available, affiliates brute-force exposed login portals or buy a ready-made foothold from an initial access broker. In May 2026 the group announced a partnership with BreachForums specifically to recruit affiliates, penetration testers and access brokers.
Stealer-log credentials, broker listings and recruitment posts all live on criminal forums and Telegram channels. If your domain or VPN logins show up there, the window before an affiliate uses them can be short.
Inside a Gentlemen Attack
Once inside, affiliates follow a fairly consistent path, based on reports from Trend Micro, Check Point and Unit 42:
- Mapping the domain. Enumerating Active Directory and scanning the network with tools such as Advanced IP Scanner.
- Escalating privileges. Using techniques such as NTLM relay attacks (CVE-2025-33073) and harvested admin credentials.
- Killing security tools. Loading a vulnerable but legitimately signed driver (the ThrottleStop driver, CVE-2025-7771) and a custom EDR-killer called GentleKiller to switch off endpoint protection.
- Stealing sessions and data. Harvesting browser sessions for Microsoft 365 and Okta, then exfiltrating files with WinSCP, Rclone or cloud storage tools.
- Deploying ransomware domain-wide. Pushing the encryptor through Group Policy and the NETLOGON share so it runs on many machines at once. Newer Go-based versions can also spread on their own, worm-style.
- Encrypting everything that matters. The ransomware targets Windows, Linux, VMware ESXi and NAS devices, deletes shadow copies and clears logs, then leaves a README-GENTLEMEN.txt note in each folder.
What the 2026 Leak Revealed
In May 2026 the group's own administrator admitted on underground forums that its backend database had been compromised. Check Point Research links the breach to the group's hosting provider and obtained part of the data, including internal chats, negotiation transcripts and member lists. Three findings stand out.
AI-assisted development
The leaked chats show the team using AI coding assistants, including DeepSeek and Qwen, to speed up development. The administrator reportedly built the entire affiliate admin panel in three days with AI help. Defenders should expect ransomware tooling to keep improving faster than before.
A small core team
Behind hundreds of attacks sits a core of around nine named operators centred on one administrator. Most of the scale comes from affiliates.
Chain victimisation through suppliers
In April 2026 the group breached a UK software consultancy, then used its infrastructure documents, credentials and client access details to attack one of the consultancy's clients in Turkey. It published both companies on its leak site and labelled the UK firm its "access broker", a tactic designed to turn the client against its own supplier.
The UK–Turkey case shows that a breach at an IT provider can hand attackers everything they need to reach that provider's customers. Monitoring exposure of your vendors' credentials and domains is no longer optional.
Who The Gentlemen Targets
- Manufacturing is the most hit sector, with 103 of 580 claimed victims in Unit 42's count. See dark web monitoring for manufacturing.
- Technology companies are the next largest group, according to Check Point, including IT providers whose access can be reused against their clients. See dark web monitoring for SaaS and technology.
- Healthcare ranks third in Check Point's analysis. See dark web monitoring for healthcare.
- Construction and insurance featured among the earliest victims documented by Trend Micro.
Early attacks focused on Asia-Pacific, especially Thailand. By 2026 the United States had the most identified victims, with the UK and Germany also heavily represented.
Dark Web Warning Signs to Watch
DarkThreat watches stealer logs, criminal forums, Telegram channels and ransomware leak sites for these signals and alerts your team when your domains, credentials or suppliers appear. See DarkThreat plans.
How to Defend Against The Gentlemen
- Patch edge devices first. Prioritise FortiGate, VPN and SSH flaws listed in the CISA Known Exploited Vulnerabilities catalogue, including CVE-2024-55591 and CVE-2025-32433.
- Assume some credentials are already exposed. Enforce phishing-resistant MFA and watch authentication logs for impossible travel and new device sign-ins.
- Harden Active Directory. Patch CVE-2025-33073, review Active Directory Certificate Services, and alert on Group Policy changes and new scripts in NETLOGON.
- Block vulnerable drivers. Use Microsoft's vulnerable driver blocklist and alert when security agents stop unexpectedly.
- Protect ESXi and NAS. Keep management interfaces off the general network and restrict admin access.
- Keep offline, immutable backups that sit outside the domain, so a domain-wide compromise cannot reach them.
- Watch your suppliers. Monitor for leaked credentials of IT providers and MSPs and review what access they hold.
Key Takeaways
- The Gentlemen grew out of a Qilin affiliate team and became the second most active ransomware group of 2026.
- A 90 percent affiliate share pulled experienced attackers away from rival programs.
- Unpatched FortiGate firewalls, stolen VPN and SSO credentials, and broker access are its main entry points.
- It uses AI coding tools, an EDR killer and domain-wide deployment, and can encrypt Windows, Linux, ESXi and NAS.
- Leaked credentials and supplier exposure on the dark web often appear before an attack.
Frequently Asked Questions
Is The Gentlemen connected to Qilin?
Its founders came from ArmCorp, a former Qilin affiliate team, and left after a payout dispute in 2025. The two are now competitors.
What does the README-GENTLEMEN.txt file mean?
It is the group's ransom note. If you find it on your systems, isolate affected machines, preserve evidence and start your incident response process immediately.
Is there a free decryptor for The Gentlemen?
No public free decryptor has been reported. The ransomware uses modern encryption (XChaCha20 with Curve25519), so recovery depends on clean, offline backups.
Why is it called "a new group to watch"?
It went from zero to one of the top two ransomware operations in about a year, its affiliate base is still growing, and its use of AI-assisted development suggests its tooling will keep evolving.
How can dark web monitoring help?
It spots the early signals: your credentials in stealer logs, access to your network for sale, a supplier listed on a leak site, or your own name on The Gentlemen's site, giving you time to act.
Related Resources
- Qilin Ransomware: Dark Web Activity and Business Risks
- Ransomware-as-a-Service Affiliate Programs: How the Business Model Works
- Infostealer Logs: What They Contain and Why You Need to Monitor Them
- Initial Access Brokers: How Dark Web Monitoring Exposes Them
- Supply Chain Credential Leaks: Monitoring Vendor Exposure
- How to Protect Your Backups from Ransomware
Sources
- Check Point Research: What The Gentlemen leak reveals about modern ransomware risk
- Palo Alto Networks Unit 42: The Gentlemen ransomware
- Barracuda: The Gentlemen ransomware, inside one of the fastest-growing extortion operations
- Trend Micro: Unmasking The Gentlemen ransomware
- IT Brief: The Gentlemen becomes second most active ransomware group
