Threat Group Profile
thegentlemen
โ Active โ last 30 days
Victim claims
501
First seen
Mar 2026
Last activity
22 Aug 2026
Tracked since
Sep 2025
Group overview
The Gentlemen is a RaaS group that emerged in JulyโAugust 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
Preferred targets
Manufacturing ยท 79
Business Services ยท 53
Technology ยท 49
Healthcare ยท 43
Agriculture and Food Production ยท 27
Transportation/Logistics ยท 23
Most targeted countries
US ยท 107
DE ยท 29
GB ยท 25
FR ยท 23
IT ยท 21
IN ยท 19
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts
Valid Accounts: Domain Accounts
External Remote Services
Exploit Public-Facing Application
Phishing
Execution
Windows Management Instrumentation
Command and Scripting Interpreter
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: Windows Command Shell
Software Deployment Tools
Persistence
Create Account
Create or Modify System Process
Boot or Logon Autostart Execution
Privilege Escalation
Exploitation for Privilege Escalation
Forced Authentication
Adversary-in-the-Middle
Defense Evasion
Obfuscated Files or Information
Indicator Removal
Proxy
Modify Registry
Domain Policy Modification: Group Policy Modification
Impair Defenses
Impair Defenses: Disable or Modify Tools
Credential Access
OS Credential Dumping
Brute Force
Unsecured Credentials
Credentials from Password Stores
Discovery
Remote System Discovery
Network Service Discovery
Permission Groups Discovery
Account Discovery
Account Discovery: Domain Account
Domain Trust Discovery
Cloud Service Discovery
Lateral Movement
Remote Services
Remote Services: Remote Desktop Protocol
Remote Services: SMB/Windows Admin Shares
Remote Services: SSH
Remote Service Session Hijacking