INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Gentlemen ransomware group targets 483 victims across 66 countries

| 2026-06-15 06:58 HIGH HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
The Gentlemen ransomware group, which surfaced in September 2025, has been responsible for hitting 483 victims across 66 countries in under a year. The majority of the victims are from non-US countries, with only about 15% located in the United States, whereas US targets typically represent around 40-50% of major leak sites. Manufacturing is the top targeted sector, followed by technology, business services, and healthcare, with 44 listed victims. The group's attack works by exploiting internet-facing vulnerabilities such as FortiOS authentication-bypass flaws and older Active Directory weaknesses, using valid credentials stolen from compromised mailboxes to find VPN logins and send phishing emails. Currently, the Gentlemen ransomware operation remains active, with a core team building and maintaining the ransomware and negotiation panel while external operators carry out intrusions and keep 90% of each ransom payment.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2024-55591 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc.
Technical Observables 4 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 4 IoCs Create Free Account
emails 2 domains 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Black BastaBlack BastaQilinQilin CVE-2024-55591CVE-2024-55591
Target & Sectors
LATAM LATAM NORTH_AMERICA NORTH_AMERICA DACH DACH ASEAN ASEAN manufacturingmanufacturing
Incident Timeline
‎February 2025
The Gentlemen group used stolen data and phishing tactics, including a 2025 Black Basta chat leak as training material, to target approximately 483 victims across 66 countries in under a year.
tactic Phishing
First, the group studied the February 2025 Black Basta chat leak and treated it as a training manual, copying phishing and mailbox-abuse workflows rather than building their own from scratch.
malware Black Basta
First, the group studied the February 2025 Black Basta chat leak and treated it as a training manual, copying phishing and mailbox-abuse workflows rather than building their own from scratch.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking,  The Gentlemen ransomware)
victims 483 victims
The result is 483 victims across 66 countries in under a year, assembled by a team small enough to share one table.
organisation Microsoft
Microsoft has separately documented a self-propagating Go-based encryptor attributed to the group, but the real leverage increasingly comes from the stolen data and the victim’s own contact list, not the locked files.
organisation MFA
Move high-value access to hardware-backed or passkey authentication that doesn’t produce replayable session cookies, because stolen cookies defeat SMS and push-based MFA entirely.
organisation Harden Active Directory
Harden Active Directory against ZeroLogon and PetitPotam, segment the network so one compromised host can’t reach everything, and keep offline tested backups while assuming data was stolen regardless of whether files were encrypted.
organisation ZeroLogon
Harden Active Directory against ZeroLogon and PetitPotam, segment the network so one compromised host can’t reach everything, and keep offline tested backups while assuming data was stolen regardless of whether files were encrypted.
‎September 2025
The Gentlemen group emerged as a ransomware operation in September 2025.
tactic Ransomware
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
victims 483 victims
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
general_metric 380 leak site
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
‎November 7, 2025
Threat actors, later identified as the Gentlemen group, leaked internal chats on November 7, 2025.
‎April 30, 2026
Threat actors used internet-facing vulnerabilities, including the FortiOS authentication-bypass flaw and older Active Directory weaknesses, to gain initial access into victims' networks.
victims 44 listed victims
Manufacturing is the top targeted sector, followed by technology, business services, and healthcare with 44 listed victims.
financial 20 dollar
The leaked chats explain why: operators were told to prioritise what they called Tier 1 to 3 countries and Latin America, and to weigh operational pain over raw revenue, reasoning that a 20 million dollar utility can pay faster than a 200 million dollar manufacturer if the lock genuinely halts the business.” reads the report published by The RansomNews research team.
financial 200 dollar
The leaked chats explain why: operators were told to prioritise what they called Tier 1 to 3 countries and Latin America, and to weigh operational pain over raw revenue, reasoning that a 20 million dollar utility can pay faster than a 200 million dollar manufacturer if the lock genuinely halts the business.” reads the report published by The RansomNews research team.
organisation Active Directory
Operators scanned for and exploited internet-facing vulnerabilities including the FortiOS authentication-bypass flaw CVE-2024-55591 , alongside older Active Directory weaknesses like ZeroLogon and PetitPotam .
organisation PetitPotam
Operators scanned for and exploited internet-facing vulnerabilities including the FortiOS authentication-bypass flaw CVE-2024-55591 , alongside older Active Directory weaknesses like ZeroLogon and PetitPotam .
‎May 2026
External operators of the Gentlemen group used commodity infostealer malware to steal credentials, which were then used by a small core team to build and maintain ransomware tools.
‎June 13, 2026
Threat actors behind the Gentlemen ransomware group listed 483 victims on their dark-web leak site by June 13, 2026.
tactic Ransomware
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
victims 483 victims
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
general_metric 380 leak site
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
‎2026/06/15
The Gentlemen ransomware group, led by a Russian and English-speaking administrator using the nickname Zeta88 or Hastalamuerte, used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year.
victims 483 victims
Infostealers, AI, and a 90% Affiliate Cut Fuel The Gentlemen group’s Rise The Gentlemen ransomware used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year.
victims 332 published victims
Check Point found The Gentlemen are the second most active ransomware group by victim count so far this year, claiming at least 332 published victims since the group’s inception in mid-2025 and more than 240 in 2026 alone.
Tactical Metrics
Metrics
victims
44
Listed Victims
Manufacturing is the top targeted sector, followed by technology, business services, and healthcare with 44 listed victims.
Metrics
victims
483
Victims
Infostealers, AI, and a 90% Affiliate Cut Fuel The Gentlemen group’s Rise The Gentlemen ransomware used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year.
The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.
The result is 483 victims across 66 countries in under a year, assembled by a team small enough to share one table.
Metrics
financial
20,000,000
Dollar
The leaked chats explain why: operators were told to prioritise what they called Tier 1 to 3 countries and Latin America, and to weigh operational pain over raw revenue, reasoning that a 20 million dollar utility can pay faster than a 200 million dollar manufacturer if the lock genuinely halts the business.” reads the report published by The RansomNews research team.
Metrics
financial
200,000,000
Dollar
The leaked chats explain why: operators were told to prioritise what they called Tier 1 to 3 countries and Latin America, and to weigh operational pain over raw revenue, reasoning that a 20 million dollar utility can pay faster than a 200 million dollar manufacturer if the lock genuinely halts the business.” reads the report published by The RansomNews research team.
Metrics
victims
332
Published Victims
Check Point found The Gentlemen are the second most active ransomware group by victim count so far this year, claiming at least 332 published victims since the group’s inception in mid-2025 and more than 240 in 2026 alone.
Intelligence Sources
Krebs On Security 2026-06-10
Security Affairs 2026-06-15