Ransomware Intelligence / Groups / the gentlemen

Ransomware group

the gentlemen

  • 7claims, 7 days
  • 100claims, 30 days
  • 395claims, 90 days
  • 2026-07-17first seen
  • 2026-10-11last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-04-20: 0Week of 2026-04-27: 0Week of 2026-05-04: 0Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 4Week of 2026-07-20: 32Week of 2026-07-27: 44Week of 2026-08-03: 39Week of 2026-08-10: 21Week of 2026-08-17: 76Week of 2026-08-24: 21Week of 2026-08-31: 10Week of 2026-09-07: 21Week of 2026-09-14: 30Week of 2026-09-21: 22Week of 2026-09-28: 35Week of 2026-10-05: 43Week of 2026-10-12: 0
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Manufacturing 78
  2. Retail 46
  3. Unclassified 45
  4. Construction 34
  5. Professional services 34
  6. Technology 30
  7. Healthcare 28
  8. Financial services 16
  9. Other 15
  10. Government 12
  11. Hospitality 11
  12. Critical infrastructure 10
  13. Nonprofit 10
  14. Transportation and logistics 10
  15. K-12 education 8
  16. Higher education 5
  17. Media and entertainment 3

Countries claimed, last 90 days

  1. United States 113
  2. Unknown 47
  3. India 17
  4. Italy 15
  5. Canada 14
  6. France 12
  7. Australia 10
  8. Brazil 9
  9. United Kingdom 9
  10. Taiwan 9
  11. Chile 8
  12. Spain 8
  13. Poland 7
  14. Austria 6
  15. Portugal 6

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog does not attribute entries to a specific group; this is the current patch list for any ransomware operator.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Data sources

  • Source: CISA KEV
    updated 2 hours ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 2 hours ago
  • Source: RansomLook
    updated 2 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 2 hours ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.