Ransomware Intelligence / Groups / the gentlemen

Ransomware group

the gentlemen

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

  • 69claims, 7 days
  • 204claims, 30 days
  • 470claims, 90 days
  • 2026-04-04first seen
  • 2026-11-03last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-05-11: 15Week of 2026-05-18: 20Week of 2026-05-25: 6Week of 2026-06-01: 24Week of 2026-06-08: 22Week of 2026-06-15: 37Week of 2026-06-22: 24Week of 2026-06-29: 43Week of 2026-07-06: 41Week of 2026-07-13: 23Week of 2026-07-20: 32Week of 2026-07-27: 44Week of 2026-08-03: 39Week of 2026-08-10: 21Week of 2026-08-17: 76Week of 2026-08-24: 22Week of 2026-08-31: 10Week of 2026-09-07: 21Week of 2026-09-14: 30Week of 2026-09-21: 38Week of 2026-09-28: 35Week of 2026-10-05: 45Week of 2026-10-12: 37Week of 2026-10-19: 6Week of 2026-10-26: 92Week of 2026-11-02: 25
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

In the news

Recent stories in the security press that name the gentlemen, newest first.

Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked

Sectors claimed, last 90 days

  1. Manufacturing 80
  2. Retail 50
  3. Technology 49
  4. Healthcare 46
  5. Unclassified 45
  6. Professional services 43
  7. Construction 40
  8. Other 17
  9. Financial services 15
  10. Government 15
  11. Hospitality 14
  12. K-12 education 14
  13. Nonprofit 13
  14. Transportation and logistics 13
  15. Critical infrastructure 9
  16. Higher education 6
  17. Media and entertainment 1

Countries claimed, last 90 days

  1. United States 113
  2. Unknown 45
  3. United Kingdom 23
  4. Brazil 18
  5. Germany 17
  6. Canada 16
  7. Italy 15
  8. Australia 13
  9. India 13
  10. Spain 12
  11. Mexico 12
  12. South Africa 10
  13. France 9
  14. Sweden 9
  15. Taiwan 9

Vulnerabilities the gentlemen exploits

CVEs attributed to the gentlemen by Ransomware.live, most severe first. Patch these first if this group is in your threat model.

CVE Vendor / product CVSS CISA KEV
CVE-2026-15409 SonicWall SMA1000 10.0 Critical Listed 2026-07-14, ransomware use
CVE-2025-55182 Meta react-server-dom-webpack 10.0 Critical Listed 2025-12-05, ransomware use
CVE-2025-32433 erlang otp 10.0 Critical Listed 2025-06-09
CVE-2026-9082 Drupal Drupal core 9.8 Critical Listed 2026-05-22
CVE-2026-63030 WordPress WordPress 9.8 Critical Listed 2026-07-21
CVE-2026-35616 Fortinet FortiClientEMS 9.8 Critical Listed 2026-04-06
CVE-2024-55591 Fortinet FortiOS 9.8 Critical Listed 2025-01-14, ransomware use
CVE-2026-42208 BerriAI litellm 9.3 Critical Listed 2026-05-08
CVE-2026-41940 WebPros cPanel 9.3 Critical Listed 2026-04-30, ransomware use
CVE-2025-33073 Microsoft Windows 10 Version 1507 8.8 High Listed 2025-10-20
CVE-2017-0144 MS Server Products SMBv1 8.8 High Listed 2022-02-10, ransomware use
CVE-2024-21412 Windows SmartScreen 8.1 High Listed 2024-02-13, ransomware use
CVE-2021-36942 Windows Local Security Authority (LSA) 7.5 High Listed 2021-11-03, ransomware use
CVE-2020-1472 Windows NetLogon 5.5 Medium Listed 2021-11-03, ransomware use
Newest vulnerabilities used by any ransomware group (CISA KEV)
Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Tactics and techniques

MITRE ATT&CK techniques reported for the gentlemen by Ransomware.live, in attack order.

Remote encryption risk. The techniques reported for the gentlemen include encrypting data (T1486) and spreading over SMB / Windows admin shares (T1021.002): the building blocks of remote encryption, where files on protected servers are encrypted over the network from a device the attacker controls.

Read our remote encryption briefing →

Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact

Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago

Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology