THE GENTLEMEN

The Gentlemen is a ransomware-as-a-service operation that, in barely over a year of existence, has become the single most prolific ransomware brand on the internet by volume. Formed in July 2025 out of a payment dispute with the Qilin RaaS program — its founder publicly alleged Qilin owed him roughly $48,000 in unpaid affiliate commissions — the group spent two months building its own infrastructure before opening its doors to affiliates in September 2025. By the first five months of 2026 it had claimed more than 328 victims across 66 countries, and by Q2 2026, Cyble Research and Intelligence Labs ranked it the most active ransomware operation globally, ahead of established brands like LockBit, Cl0p, and RansomHub (The Insurer, 2026-07-24; Halcyon, 2026).

What makes this growth curve unusual is not just its speed — the group matched in five months what took Akira twelve months and Qilin eighteen months to reach (Halcyon, 2026) — but the mechanism behind it. The Gentlemen offers affiliates a 90% cut of ransom proceeds, a figure matched previously only by RansomHub against the RaaS industry standard of 70–80% (Halcyon, 2026). That economic aggression, paired with a genuinely multi-platform Go-based locker capable of encrypting Windows, Linux, BSD, and NAS hosts alongside a dedicated C-based ESXi variant, has let a small core team punch far above its headcount.

On May 4, 2026, the group's own internal operational backend — a system it calls "Rocket" — was compromised and partially leaked by a third party operating under the handle "n7778." The leak included a server shadow file exposing operator usernames, roughly 44 megabytes of an estimated 16-gigabyte internal chat log archive, and enough operational detail that Check Point Research was able to publish an unusually granular profile of the group's leadership, tooling, and internal culture (Check Point Research, "Thus Spoke…The Gentlemen," 2026). That leak, rather than slowing the group down, arrived in the middle of its steepest growth quarter — underscoring that this operation's resilience does not depend on operational secrecy in the way older, more centralized ransomware brands did.

As of this compile date, no government has issued sanctions, no indictment has been unsealed, and MITRE has not yet assigned the group a formal ATT&CK Group ID — all consistent with an operation that, however large, is still under a year old in its current form. That absence of formal legal or framework recognition should not be read as an absence of threat: the group's targeting explicitly avoids Commonwealth of Independent States countries, a pattern consistent with Russian-speaking operators operating under an informal non-aggression understanding with their home region's law enforcement, and its scaling trajectory now sits well past the volume threshold that historically has triggered coordinated international takedown operations against comparable brands (LockBit, Hive).

Initial access is affiliate-driven and opportunistic rather than centrally curated: internet-exposed edge devices (Fortinet FortiGate, Cisco appliances), OWA/Microsoft 365 credential brute-forcing, and VPN/RDP abuse are the dominant entry vectors, with the group's own leaked chat logs showing active tracking and evaluation of CVE-2024-55591 (FortiOS management-interface authentication bypass), CVE-2025-32433 (Erlang/OTP SSH vulnerability relevant to Cisco-hosted contexts), and CVE-2025-33073 (NTLM relay/reflection) as preferred exploitation paths (Check Point Research, 2026). A dedicated operator, "quant," maintains a high-specification credential-harvesting rig (Threadripper PRO, 128 GB RAM, RTX 5090) purpose-built for brute-forcing and a custom collection tool nicknamed "buildx641" for pulling credentials out of compromised OWA/O365 mail stores.

Once inside, the group's defining technical trait is the aggressiveness of its lateral spread: Microsoft documented up to 21 independent execution attempts per target host, staged from a hidden SMB share (share$) the malware creates on the initial foothold and an embedded copy of PsExec it deploys onto the network. From there it fans out via remote file copy over C$ administrative shares, PsExec, WMIC process creation, PowerShell remoting (Invoke-Command), direct WMI class invocation, and both user- and SYSTEM-context scheduled tasks and Windows services — each attempted from two staging locations (the infected host's own SMB share, and the target's local C:\Temp) to maximize the odds that at least one vector succeeds against a given host's specific defensive posture (Microsoft Security Blog, 2026-05-28).

Immediately before encryption, the locker systematically disables Microsoft Defender's real-time protection and firewall, deletes Volume Shadow Copy backups, terminates roughly 50 processes spanning databases, backup software (Veeam, Ipelius), EDR agents, and remote-access tools, and clears the Security, System, and Application Windows Event Logs. Encryption itself uses a per-file ephemeral Curve25519 key exchange feeding an XChaCha20 stream cipher, with a size-tiered strategy — files at or under 1 MB are fully encrypted, larger files are partially encrypted in distributed chunks at operator-selectable speed settings (roughly 27% down to under 1% of file content, depending on the "fast," "superfast," or "ultrafast" mode chosen) — a deliberate speed/thoroughness tradeoff that lets affiliates encrypt very large environments before defenders can react. Exfiltrated data and the encryption event both feed into a double-extortion negotiation conducted over individual, affiliate-specific Tox IDs rather than a centralized negotiation portal, and the group maintains a public X/Twitter account specifically to name non-paying victims for reputational pressure (Halcyon, 2026).

The group's growth rate is itself the primary threat signal here, more than any single technical capability. Matching in five months what took Akira a year and Qilin eighteen months to reach is not simply a function of aggressive marketing (the 90% affiliate split) — it reflects a genuinely competent, genuinely multi-platform toolchain that lowers the skill floor for affiliates while still producing five-figure-to-six-figure ransom outcomes (the documented UK consultancy negotiation closed at $190,000 against an opening demand of $250,000). A RaaS operation that can absorb and productively deploy a large, loosely-coordinated affiliate base without its core tooling falling apart is a durable threat model, not a flash in the pan.

There is a genuine epistemological wrinkle worth naming directly: an unusually large share of what is publicly known about this group's internal structure, personnel, and culture derives from one leaked archive of the group's own internal chat logs (the May 2026 "Rocket" breach), not from independent law-enforcement seizure or long-term external telemetry the way older, better-established RaaS brands have been profiled. Check Point Research's willingness to publish detailed personnel attribution rests on cross-corroboration between that leaked chat content and independently observable artifacts — malware samples, C2 infrastructure, TOX IDs tied to actual campaigns — which is a reasonable evidentiary basis, but analysts should hold open the possibility that some leaked internal chat content reflects affiliate bravado or exaggeration rather than verified operational fact, particularly around claimed revenue figures and negotiation outcomes not independently confirmed by victim-side reporting.

Forward trajectory: the group's current volume and geographic spread now sit well past the threshold that has historically triggered coordinated international law-enforcement action against comparable brands (LockBit's 2024 disruption, Hive's 2023 takedown) — no such action has been publicly reported against The Gentlemen as of this compile date, but the gap between "operationally significant enough to attract that response" and "actually receiving it" has narrowed. What would change this assessment: a formal government attribution/sanction action (none exists yet), independent (non-leak-derived) confirmation of the personnel roster via arrest or seizure, or a public law-enforcement disruption of the "Rocket" infrastructure itself.