INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

The Gentlemen Ransomware Claims 478 Victims via Dark Web

| 2026-06-11 16:50 CRITICAL HIGH RANSOMWARE & EXTORTION
JSON
Executive Summary
AI-generated
Phantom Mantis, a financially motivated threat group led by Russian-speaking cybercriminal LARVA-368, has been observed paying for Premium accounts on underground forums to boost their visibility and fend off competition. The group's communication and technical support are handled by a separate persona named The Gentlemen Data. As of June 11, 2026, Phantom Mantis claims to have affected at least 478 victims worldwide since its transition into an independent partnership program in July 2025. LARVA-368 relies heavily on artificial intelligence for the development and maintenance of ransomware tools, as well as post-exploitation procedures. The group's tactics involve leveraging resources from various ransomware-as-a-service schemes like LockBit, Qilin, and Medusa.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2024-55591, CVE-2025-33073 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 6 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 6 IoCs Create Free Account
emails 2 domains 4
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
EmbargoEmbargoQilinQilin CVE-2024-55591CVE-2024-55591 CVE-2025-33073CVE-2025-33073 CVE-2025-32433CVE-2025-32433
Target & Sectors
DACH DACH
Incident Timeline
‎March 2025
Threat actors using The Gentlemen ransomware claimed a total of 478 victims since its activation in March 2025.
organisation Ransomware
The Gentlemen is known to be active since March 2025, claiming a total of 478 victims to date, per data from Ransomware.
victims 478 Victims
The Gentlemen is known to be active since March 2025, claiming a total of 478 victims to date, per data from Ransomware.
‎2025/06/11
Threat actors utilizing The Gentlemen ransomware operation claimed 478 victims, combining mature techniques with RaaS features and double extortion methods.
tactic Ransomware
Some of the other salient aspects of the extortion scheme compiled from various reports are as follows - In an analysis of the ransomware in late last year, LevelBlue's Cybereason team described The Gentlemen as a "highly adaptive, fast-moving ransomware operation" that combines mature ransomware techniques with RaaS features, double extortion, cross-platform lockers, and flexible propagat…
tactic Extortion
Some of the other salient aspects of the extortion scheme compiled from various reports are as follows - In an analysis of the ransomware in late last year, LevelBlue's Cybereason team described The Gentlemen as a "highly adaptive, fast-moving ransomware operation" that combines mature ransomware techniques with RaaS features, double extortion, cross-platform lockers, and flexible propagat…
organisation LevelBlue
Some of the other salient aspects of the extortion scheme compiled from various reports are as follows - In an analysis of the ransomware in late last year, LevelBlue's Cybereason team described The Gentlemen as a "highly adaptive, fast-moving ransomware operation" that combines mature ransomware techniques with RaaS features, double extortion, cross-platform lockers, and flexible propagat…
‎July 2025
The Gentlemen ransomware group, led by 36-year-old Alexander Andreevich Yapaev from Russia, transitioned into an independent partnership program in July 2025.
source_region Switzerland
"In July 2025, Phantom Mantis transitioned into The Gentlemen, an independent partnership program no longer dependent on other RaaS groups," the Swiss cybersecurity company said.
organisation The Hacker News
PRODAFT told The Hacker News that its findings match the same persona with "high confidence.
‎August 2025
Phantom Mantis's admin, LARVA-368, and a former member, LARVA-367 (aka DevMan), accused Pestilent Mantis of scamming affiliates.
malware Qilin
" As detailed by Dark Atlas in August 2025, the shift coincided with a payment dispute between LARVA-368 and Qilin, with the threat actor accusing the RaaS operation of carrying out an exit scam and defrauding them of $48,000.
organisation LARVA-368
" As detailed by Dark Atlas in August 2025, the shift coincided with a payment dispute between LARVA-368 and Qilin, with the threat actor accusing the RaaS operation of carrying out an exit scam and defrauding them of $48,000.
organisation the Pestilent Mantis's
"Although Phantom Mantis was a very active affiliate group with over 20 targets registered on its affiliate panel in less than 30 days, the group's admin (LARVA-368) and LARVA-367 (aka DevMan ), a former Phantom Mantis's member, claimed that Pestilent Mantis was scamming affiliates and that there was an alleged 'backdoor' within the Pestilent Mantis's affiliate panel victim chats," PRODAFT noted.
victims 20 targets
"Although Phantom Mantis was a very active affiliate group with over 20 targets registered on its affiliate panel in less than 30 days, the group's admin (LARVA-368) and LARVA-367 (aka DevMan ), a former Phantom Mantis's member, claimed that Pestilent Mantis was scamming affiliates and that there was an alleged 'backdoor' within the Pestilent Mantis's affiliate panel victim chats," PRODAFT noted.
‎November 2025
Threat actors used known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software to target victims.
organisation VMware Aria Operations
Chat database used by the group - comprising 3,366 messages between November 2025 to late April 2026 - has shed further light on the group's inner workings, including its use of known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, while painting a picture of a criminal enterprise whose members have a clear division of roles and responsibilities.
general_metric 3,366 comprising messages
Chat database used by the group - comprising 3,366 messages between November 2025 to late April 2026 - has shed further light on the group's inner workings, including its use of known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, while painting a picture of a criminal enterprise whose members have a clear division of roles and responsibilities.
general_metric 2026 late April
Chat database used by the group - comprising 3,366 messages between November 2025 to late April 2026 - has shed further light on the group's inner workings, including its use of known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, while painting a picture of a criminal enterprise whose members have a clear division of roles and responsibilities.
‎March 2026
Threat actors attributed to a The Gentlemen RaaS affiliate used an open directory on the Russian hosting provider Proton66 to expose 126 files containing ransomware tools.
target_region Russian Federation
In March 2026, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate.
tactic Ransomware
In March 2026, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate.
data_breach 126 files
In March 2026, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate.
‎April 2026
The Gentlemen ransomware crew likely runs a multi-channel extortion operation, combining ransomware attacks with email outreach and phone-based pressure tactics targeting victims.
tactic Ransomware
The group has emerged as one of the most active threat actors, accounting for 10% of ransomware activity in April 2026.
general_metric 10 %
The group has emerged as one of the most active threat actors, accounting for 10% of ransomware activity in April 2026.
infrastructure Windows
Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
Microsoft, which is tracking the cluster under the moniker Storm-2697, said the ransomware is written in Go and obfuscated with Garble to target the Windows environment.
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
infrastructure Linux
Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
organisation Logical Volume
Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
organisation Microsoft
Microsoft, which is tracking the cluster under the moniker Storm-2697, said the ransomware is written in Go and obfuscated with Garble to target the Windows environment.
organisation ZeroFox
" According to ZeroFox, the ransomware crew likely runs a multi-channel extortion operation, combining ransomware attacks with email outreach and phone-based pressure tactics targeting victims.
organisation Infection
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery.
organisation NetExec
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery.
organisation TaskHound
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery.
organisation PrivHound
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery.
organisation CertiHound
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound to perform Active Directory discovery, certificate abuse, privilege escalation, and file share discovery.
organisation affiliates
The group courts affiliates with an aggressive profit-sharing model: 90% for affiliates and 10% for the operator.
organisation System
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
organisation Security Windows Event Logs
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
organisation Microsoft Defender
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
infrastructure Fortigate
Initial access is obtained via edge devices such as VPN appliances, firewalls, and other internet-facing systems, with a specific focus on platforms like Cisco and Fortinet FortiGate.
organisation CVE-2025
Image Source: Ransom-ISAC "The group actively tracks and evaluates modern vulnerabilities, including CVE-2024-55591 , CVE-2025-32433 , and CVE-2025-33073 , and combines them with technique-driven paths like backup and management-controller abuse and NTLM relay workflows, giving them a flexible exploitation pipeline," Check Point said .
organisation NTLM
Image Source: Ransom-ISAC "The group actively tracks and evaluates modern vulnerabilities, including CVE-2024-55591 , CVE-2025-32433 , and CVE-2025-33073 , and combines them with technique-driven paths like backup and management-controller abuse and NTLM relay workflows, giving them a flexible exploitation pipeline," Check Point said .
organisation NCC Group
"The Gentlemen follows an enterprise-focused chain beginning with initial access, via vulnerable internet-facing services or stolen credentials," NCC Group said .
organisation EDR
LARVA-368 uses The Gentlemen IM app accounts to support affiliates regarding encryption and any intrusion-related issue, such as providing EDR killers to bypass security solutions via the bring your own vulnerable driver (BYOVD) technique.
organisation VMware
The average dwell time of an intrusion ranges from two to six weeks from initial access to encryption, with the group particularly focusing on organizations running VMware infrastructure.
data_breach 1 GB
Potential affiliates are required to provide the administrator at least 1GB of data exfiltrated from a victim to gain access to the affiliate panel, a tactic designed to prevent researchers and law enforcement authorities from gaining access to the infrastructure under the guise of an affiliate.
‎2026/05/12
Threat actors leaked an internal Rocket vulnerability, which was later exploited by the Gentlemen ransomware group to target at least 478 victims.
‎2026/06/11
The Gentlemen ransomware group's administrator, identified as Alexander Yapaev or Hastalamuerte, a 36-year-old from Izhevsk, Russia, registered on multiple cybercrime forums and used various email addresses to connect with other hackers.
organisation ArmCorp
According to a detailed report published by PRODAFT, the group, which it tracks as Phantom Mantis, is led by a Russian-speaking cybercriminal it calls LARVA-368, who goes by the online aliases hastalamuerte, ArmCorp, zeta88, nobody0, and santamuerte.
victims 478 Victims
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm.
organisation LockBit
A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis).
victims 332 published victims
Check Point found The Gentlemen are the second most active ransomware group by victim count so far this year, claiming at least 332 published victims since the group’s inception in mid-2025 and more than 240 in 2026 alone.
Tactical Metrics
Metrics
data_breach
126
Files
In March 2026, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate.
Metrics
victims
478
Victims
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm.
The Gentlemen is known to be active since March 2025, claiming a total of 478 victims to date, per data from Ransomware.
Metrics
infrastructure
‎Windows
Affected Product
Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
Microsoft, which is tracking the cluster under the moniker Storm-2697, said the ransomware is written in Go and obfuscated with Garble to target the Windows environment.
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
Metrics
infrastructure
‎Linux
Affected Product
Phantom Mantis provides five versions of ransomware that are designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
Metrics
infrastructure
‎Fortigate
Affected Product
Initial access is obtained via edge devices such as VPN appliances, firewalls, and other internet-facing systems, with a specific focus on platforms like Cisco and Fortinet FortiGate.
Metrics
victims
20
Targets
"Although Phantom Mantis was a very active affiliate group with over 20 targets registered on its affiliate panel in less than 30 days, the group's admin (LARVA-368) and LARVA-367 (aka DevMan ), a former Phantom Mantis's member, claimed that Pestilent Mantis was scamming affiliates and that there was an alleged 'backdoor' within the Pestilent Mantis's affiliate panel victim chats," PRODAFT noted.
Metrics
data_breach
1
Gb
Potential affiliates are required to provide the administrator at least 1GB of data exfiltrated from a victim to gain access to the affiliate panel, a tactic designed to prevent researchers and law enforcement authorities from gaining access to the infrastructure under the guise of an affiliate.
Metrics
victims
332
Published Victims
Check Point found The Gentlemen are the second most active ransomware group by victim count so far this year, claiming at least 332 published victims since the group’s inception in mid-2025 and more than 240 in 2026 alone.
Intelligence Sources
Krebs On Security 2026-06-10
The Hacker News 2026-06-11