Gentlemen
Gentlemen is a ransomware-as-a-service (RaaS) operation that emerged in 2025 and became one of the most active ransomware groups in 2026. Reporting in the provided content describes it as a Russian-speaking ransomware group and links its founding to a former Qilin affiliate using the handle hastalamuerte; some reporting also identifies the leader as zeta88/hastalamuerte. Gentlemen uses a double-extortion model, combining data theft with file encryption, and operates an affiliate program. The group has been observed advertising on underground forums including Rehub since September 2025. A defining characteristic of Gentlemen is that its operators centrally develop, maintain, and distribute endpoint detection and response (EDR) killing tools to affiliates rather than leaving defense evasion to individual operators. ESET named the group’s in-house framework GentleKiller. The content states that GentleKiller has at least eight variants, uses bring-your-own-vulnerable-driver techniques, abuses vulnerable or malicious kernel drivers, repeatedly terminates security processes in a loop, and targets more than 400 process names associated with 48 security products. The group also uses externally sourced EDR-killing tools including HexKiller, ThrottleBlood, and HavocKiller, standardized through a shared evasion and impersonation layer using fake version information, copied or invalid signatures, matching icons, and sometimes Enigma or Themida protection. The content also links the Rust-based credential stealer OxideHarvest, also referred to as buildx641, to a Gentlemen affiliate named quant. Victimology in the provided content is concentrated in Southeast Asia, South America, and Western Europe rather than being primarily US-focused. The content states that target selection is driven largely by FortiGate configuration or misconfiguration. Reported victims or claimed victims include Mackay Sugar in Australia and Romanian critical infrastructure entities, with the group claiming attacks affecting the national oil pipeline operator and a major coal-based power producer. The content also notes activity in the Middle East, Turkey, and Africa region. Known aliases in the provided content are limited to Gentlemen / The Gentlemen.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇹🇭 Thailand
- 🇧🇷 Brazil
- 🇫🇷 France
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Observables
27 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS operation that centrally develops, maintains, and distributes a portfolio of EDR-killing tools to affiliates before ransomware deployment, using double extortion and targeting organizations selected largely by FortiGate firewall configuration.
RaaS operation using the GentleKiller framework and other integrated EDR killers to disable endpoint defenses before ransomware deployment; also uses a credential stealer and rapidly operationalizes newly published BYOVD PoCs.
Ransomware-as-a-service operation centralizing development of standardized EDR-killer tooling for affiliates, rapidly operationalizing BYOVD proof-of-concept exploits, and conducting ransomware attacks at scale.
Prominent ransomware group active since early 2026, notable for maintaining sophisticated EDR-killing tools to disrupt security software and operating heavily against targets in Southeast Asia, South America, and Western Europe rather than the US.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.