Loading story…
The Gentlemen, a financially motivated, Russian-speaking ransomware-as-a-service operation, has become one of the world’s two most active ransomware groups after splitting from Qilin’s affiliate programme in July 2025. Comparitech reported 600 claimed attacks between January and July 2026, second to Qilin’s 771, but only 68 were confirmed by targeted organizations; confirmed incidents involved approximately 787,400 breached records. Belgium’s Centre for Cybersecurity reported 269 victims in Q2 2026, including at least six confirmed Belgian victims, and impacts on critical infrastructure elsewhere in the EU. The operation reportedly emerged from Qilin affiliate ArmCorp following a payment dispute, offers affiliates 90% of ransom proceeds, and announced a BreachForums partnership. Manufacturers represented roughly 24% of claimed victims, with healthcare, government and education also targeted.
The group supports affiliates with encryption and self-propagation capabilities, an operator-maintained endpoint detection and response (EDR) killer service, and a shared pool of compromised FortiGate devices and validated VPN credentials. Observed intrusions exploit known vulnerabilities using public proof-of-concept exploits; no zero-day capability has been identified. Comparitech linked rising activity to recruitment and rumored exploitation of CVE-2025-32433 and CVE-2025-33073, but did not establish exploitation of either vulnerability. Belgian authorities assess with moderate confidence that the operation is independently based in Russia or a Russian-speaking CIS jurisdiction, with no evidence of direct Russian state tasking or control. Defenders should prioritize patching internet-facing systems, reviewing VPN access and credentials, and hardening endpoint defenses against tampering.
TTPs, infrastructure, and targeting history in one profile.
51 events from the most recent confirmed update back to the earliest known activity.
Ecopetrol S.A. experienced an attack in July 2026. It reported that 3,300 user accounts could have been affected.
Italy’s HIWIN S.r.l. experienced a July 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Portugal’s Metro Mondego experienced a July 2026 incident included among confirmed government-sector attacks attributed to The Gentlemen.
The Kenaitze Indian Tribe in the United States experienced a July 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
U.S. healthcare organization AnMed experienced a confirmed attack in July 2026. The Gentlemen subsequently claimed the incident in August.
U.S. manufacturer TKMS ATLAS North America, LLC experienced a June 2026 attack identified among The Gentlemen’s confirmed incidents.
An Indra Group subsidiary in Spain experienced a June 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Poland’s Akademia Leona Koźmińskiego–Kozminski University experienced a confirmed June 2026 attack included among The Gentlemen’s education-sector incidents.
Germany’s Feuerwehr Allensbach experienced a June 2026 incident included among confirmed government-sector attacks attributed to The Gentlemen.
Denmark’s Nationalmuseet experienced a June 2026 incident included among confirmed government-sector attacks attributed to The Gentlemen.
Croatia’s Ministry of Health experienced a June 2026 incident included among confirmed government-sector attacks attributed to The Gentlemen.
U.S. healthcare organization Hooke Laboratories experienced a June 2026 incident included among The Gentlemen’s confirmed attacks.
The Gentlemen briefly overtook Qilin for the highest single-month reported victim count in June 2026.
India’s IP Rings Limited experienced a May 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Japan’s Koa Glass Co., Ltd. experienced a May 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Japan’s Oriental Diamond Co., Ltd. experienced a May 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Vysoká škola finanční a správní in the Czech Republic experienced a confirmed May 2026 attack included among The Gentlemen’s education-sector incidents.
Boyne City in the United States experienced a May 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
Poland’s Wielkopolskie Centrum Medyczne REMEDIUM sp. z o.o. confirmed a late-May 2026 systems breach affecting a broad group of patients.
Soniva Dental Care’s remote desktop web services infrastructure was attacked in May 2026. Approximately 30,000 Texas residents were potentially affected because access to patient data could not be ruled out.
A May 2026 leak of The Gentlemen’s backend infrastructure exposed roughly nine named operators. It also revealed a 90/10 revenue split, relationships with initial access brokers, and a documented chain-victimisation technique.
The Gentlemen announced a partnership with BreachForums in May 2026. It sought teams, individual penetration testers, and access brokers to expand its affiliate program worldwide.
Hospital Caribbean Medical Center began breach notifications in April 2026 following its February attack. The hospital notified 92,000 people.
U.S. manufacturer Gator Cases, LLC experienced an April 2026 attack and subsequently notified 1,171 people.
Turkey’s Arçelik A.Ş. experienced an April 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Taiwan’s Gem Terminal Industry Co., Ltd. experienced an April 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Germany’s Heinrich Kopp GmbH experienced an April 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Anderlues la Commune in Belgium experienced an April 2026 attack included among The Gentlemen’s confirmed government incidents. Its systems were paralyzed for nearly a month.
IntraCare resumed medical procedures on March 30, 2026, following the attack that began ten days earlier.
New Zealand’s IntraCare experienced an attack beginning March 20, 2026. The incident was included among The Gentlemen’s confirmed healthcare attacks.
JRK Property Holdings, Inc. detected suspicious activity in March 2026 and subsequently notified 19,919 people across seven U.S. states. The report stated that the total number affected remained unknown.
Japan’s MEDICUS SHUPPAN, Publishers Co., Ltd. experienced a March 2026 attack. It subsequently reported 641,000 affected personal-data entries, which could include duplicate entries for individuals.
Japan’s Omikenshi Co., Ltd. experienced a March 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Panama’s Caja de Seguro Social experienced a March 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
Náměšť nad Oslavou in the Czech Republic experienced a March 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
India’s Rajagiri Hospital confirmed that its March 2026 attack began with phishing and resulted in 800 GB of stolen data.
Thailand’s Sasin School of Management experienced a February 2026 attack. It reported no evidence that critical data systems were compromised.
Austria’s CHS Villach experienced a February 2026 attack and confirmed a data breach.
Brazil’s Universidade Federal de Sergipe experienced a confirmed February 2026 attack included in Comparitech’s account of The Gentlemen’s education-sector incidents.
Brazil’s Centro Universitário Filadélfia experienced a confirmed February 2026 attack included in Comparitech’s account of The Gentlemen’s education-sector incidents.
Chile’s Instituto Nacional de Derechos Humanos experienced a February 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
Hospital Caribbean Medical Center in Puerto Rico contained an attack in early February 2026. The incident was included among The Gentlemen’s confirmed healthcare attacks.
Brazil’s Unimed Anápolis confirmed an attack on January 12, 2026, but reported no evidence of a data leak.
Poland’s Wamtechnik sp. z o.o. experienced a January 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
HAFA in France experienced a January 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Japan’s Nishiyama Seisakusho Co., Ltd. experienced a January 2026 attack identified among The Gentlemen’s confirmed manufacturing incidents.
Beniel in Spain experienced a January 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
South Africa’s Witzenberg Municipality experienced a January 2026 attack included among confirmed government-sector incidents attributed to The Gentlemen.
The ransomware operation began adding victims to its leak site in September 2025.
The Gentlemen separated from Qilin’s affiliate program in July 2025. Experts cited by Comparitech attributed its formation to Qilin affiliate ArmCorp breaking away following a payment dispute.
Reporting arising from the leak of The Gentlemen’s internal Rocket.Chat infrastructure linked LARVA-368 to Alexander Andreevich Yapaev of Izhevsk, Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecomparitech.com
Open sourceblog.barracuda.com
Open sourcehalcyon.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**The Gentlemen**, also tracked as **Storm-2697**, has rapidly expanded into one of the most active ransomware-as-a-service operations, with reporting indicating it has been active since at least July 2025 and may have previously operated as the **ArmCorp** affiliate of **Qilin**. The group uses ransomware variants written in **C** and **Go**, relies on multiple initial access methods, and has developed custom tooling including a Go-based backdoor and the **GentleKiller** framework designed to disable EDR protections. Researchers said the operation formalized its RaaS model around September 2025 and attracted affiliates by offering an unusually high **90%** share of ransom payments. The group’s activity accelerated sharply in 2026, with one cited count attributing **580 claimed victims across 77 countries** through July 7, including **103** in the manufacturing sector, and **117 claimed victims in June alone**. In May 2026, The Gentlemen also partnered with **HasanBroker’s BreachForums** to recruit affiliates, penetration testers, and initial access brokers, while an alleged insider reportedly leaked an internal database the same month. The campaign’s scale has pushed The Gentlemen to the **second-most active RaaS program of 2026 by victim count**, underscoring the need for organizations to prioritize patching exploited vulnerabilities, hardening MFA and EDR defenses, segmenting networks, and ensuring resilient backups.
Jul 15, 2026
Ransomware activity intensified in 2026 as the criminal ecosystem expanded to **146 active groups** by midyear, with **61 new groups** emerging and public victim counts rising sharply across multiple regions and sectors. Black Kite reported **7,551 victims** globally, a **55.1% year-over-year increase in Europe** during the first four months of the year, and continued dominance by a small number of operators despite broader fragmentation. **Qilin** remained the leading ransomware-as-a-service operation across much of the market, benefiting from the decline of rivals such as LockBit and ALPHV, while researchers said attackers frequently gained initial access by exploiting **critical vulnerabilities** with `CVSS >= 9` and, in some cases, through phishing and supply-chain compromise. At the same time, **The Gentlemen** emerged as one of the fastest-growing threats, especially against higher education. Comparitech counted **104 ransomware attacks** against the global education sector in the first half of 2026, with attacks increasingly concentrated on colleges and universities and the United States recording the most confirmed victims. ESET said The Gentlemen equipped affiliates with the **GentleKiller** framework, a bring-your-own-vulnerable-driver toolkit designed to disable endpoint defenses before encryption, targeting more than **400 processes** across roughly **48 security products**. The group was also linked to steep growth in university attacks, including a case at **Mount Royal University** involving a **$1.9 million** ransom demand, alleged theft of more than **10TB** of data, and destructive deletion of drives.
Aug 18, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Aug 11, 2026