Ransomware Intelligence / Groups / the gentlemen
Ransomware group
the gentlemen
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- 37claims, 7 days
- 155claims, 30 days
- 450claims, 90 days
- 2026-07-17first seen
- 2026-10-16last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
Sectors claimed, last 90 days
- Manufacturing 86
- Retail 54
- Unclassified 45
- Construction 42
- Professional services 41
- Healthcare 35
- Technology 35
- Financial services 19
- Government 14
- Nonprofit 12
- Other 12
- Transportation and logistics 12
- Critical infrastructure 11
- Hospitality 11
- K-12 education 11
- Higher education 7
- Media and entertainment 3
Countries claimed, last 90 days
- United States 115
- Unknown 46
- United Kingdom 21
- Canada 18
- India 18
- Brazil 17
- Italy 14
- Australia 12
- Mexico 10
- Germany 9
- France 9
- Taiwan 9
- Austria 7
- Chile 7
- Poland 7
Vulnerabilities with known ransomware use
From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog does not attribute entries to a specific group; this is the current patch list for any ransomware operator.
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Track the gentlemen in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources
- Source: CISA KEVupdated 2 hours ago
- Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.updated 2 hours ago
- Source: RansomLookupdated 2 hours ago
- Source: Ransomware.liveupdated 2 hours ago
- Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.updated 2 hours ago
Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.