The Gentlemen ransomware: why every business should be paying attention
14th October 2026Becoming one of the world's most prolific ransomware operations in little over a year
Little more than a year after it first appeared, The Gentlemen has become one of the two most active ransomware operations in the world. Only Qilin, the gang its founder walked away from, has named more victims on its leak site this year. A new threat profile from incident response firm Barricade Cyber Solutions, drawing on research from Microsoft, Check Point, Group-IB and others, shows how fast, methodical attacks that can take an entire network down within hours.
What makes the group worth understanding is not novelty but the opposite: almost everything it does exploits weaknesses that are already known and already fixable.
From disgruntled affiliate to market leader
The Gentlemen are a Russian-speaking criminal group that emerged in mid-2025, tracked by Microsoft as Storm-2697. Group-IB traces its origins to a public row on a criminal forum, in which the leader, known as "hastalamuerte", claimed he was owed $48,000 for six weeks' work as a Qilin affiliate, before then setting up on his own.
The group runs a ransomware-as-a-service model. A core team builds the tools, runs the leak site and handles payments, while independent affiliates carry out the attacks. Affiliates can keep up to 90% of each ransom, a generous split that has helped the group recruit quickly. The results are stark. According to Barricade's tally of leak-site postings so far in 2026, The Gentlemen sit second only to Qilin:
- Qilin: 992
- The Gentlemen: 791
- Akira: 374
- INC: 344
- DragonForce: 332
Check Point puts the group's victim count at 791 across 70 countries, spanning healthcare, education, transport, manufacturing and financial services. Organisations claimed by the group include Romania's Oltenia Energy Complex, Australia's Mackay Sugar, whose two mills were shut down, and US healthcare provider Nutex Health, which reported the incident to US regulators. The pace is not slowing: on 30 September alone, the group named 25 new victims, from a South African law firm to a UK cyber security consultancy.
In May 2026, around 16GB of the gang's internal data leaked, including affiliate chats and custom tools. One exposed negotiation opened at $250,000 and settled at $190,000. The operation carried on regardless.
Anatomy of an attack
Barricade breaks a Gentlemen attack into stages, each of which maps directly to a control underwriters ask about.
- Getting in. The group targets the edge of the network, chiefly firewalls and remote access systems, exploiting unpatched flaws (especially in Fortinet equipment) and stolen or reused credentials for VPN, email and remote desktop.
- Settling in and taking the keys. It creates accounts with plausible names such as "support_fortinet", installs remote access tools such as AnyDesk, adds itself to administrator groups and harvests credentials, including those for Veeam backup software so that recovery can be disabled later.
- Blinding the defences. It switches off Microsoft Defender, excludes the entire drive from scanning and clears logs. To kill stronger endpoint tools, it loads a legitimate but flawed signed driver and uses it to terminate protection, a technique known as "bring your own vulnerable driver". ESET has named the group's maintained toolkit for this GentleKiller.
- Spreading. It moves laterally using standard admin tools, and its ransomware can propagate itself. Crucially, it often deploys through Group Policy, the same mechanism IT teams use to update every machine at once. That is why an entire estate can be hit simultaneously.
- Stealing, then locking. Data is copied out first, disguised as normal traffic. The group then stops backups, databases and virtual machines, deletes Windows recovery copies and encrypts, with dedicated lockers for Linux and VMware ESXi extending the damage to virtual infrastructure.
The result is classic double extortion, and it happens quickly. Recent reporting puts the average gap from first intrusion to encryption at around two days, and under 24 hours in the fastest cases.
A moving target
In April 2026 the group claimed to have patched its ransomware within hours of a free decryptor being published, with suggestion its leader uses AI coding assistants to build new tools in days. Barricade warns that the technical indicators security teams hunt for go stale quickly as a result. Detection based on known files will always lag; detection based on behaviour, such as security tools being disabled or recovery copies deleted, holds up far better.
What brokers should be discussing with clients
The defences are well understood. The questions worth putting to clients:
- Edge patching. Are firewalls, VPNs and ESXi hosts patched within days of a fix and is multi-factor authentication enforced on every form of remote access?
- Tamper protection. Can security software be switched off by an attacker with admin rights, and does the security team receive alerts for new antivirus exclusions, cleared logs, unusual scheduled tasks or deleted recovery copies?
- Backup resilience. Are backups segregated from the main network, offline or immutable, and protected by credentials that are not reachable from the domain? Has a full restore, including rebuilding core systems from scratch, actually been tested?
- Rehearsal. Has the client run an exercise that assumes every server, backup and file share is encrypted at once, and agreed in advance who contacts lawyers, regulators, insurers and incident responders?
The bottom line
The Gentlemen show how far ransomware has become an organised industry, with a franchise model and product updates turned around in hours. Yet its success still rests on basics, and it does not pick victims by size: any organisation with an exposed weakness and the revenue to pay is a target. For brokers, the most useful question is not whether a client could be hit, but how quickly they close known doors, and whether they would notice an intruder before Group Policy did the rest.
If you'd like to discuss the practical implications for your clients, reach out to one of the team.
Sources
- Barricade Cyber Solutions - The Gentlemen ransomware: threat actor profile
- Trend Micro - Unmasking The Gentlemen ransomware
- Check Point - The Gentlemen and SystemBC
- BankInfoSecurity - The Gentlemen suffers data leak
- Microsoft - Dissecting a self-propagating Go encryptor
- Krebs on Security - Who runs The Gentlemen?
- Cyber Security News - The Gentlemen with custom EDR/AV killers
Disclaimer
This content is intended for general informational purposes only and does not constitute legal, regulatory, financial, or insurance advice. It should not be relied upon as a substitute for professional counsel. While efforts have been made to ensure the accuracy of the information presented, no representation or warranty is made as to its completeness or applicability to any specific situation. Readers should consult their own advisors regarding their particular circumstances.