thegentlemen ransomware group

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Claims in 7 days: 22
Claims in 30 days: 138
Reported techniques: 40

Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.

Where it claims victims

Country	Claims in 60 days
United States	34
Germany	10
Brazil	8
United Kingdom	7
Canada	6
Spain	5
Australia	5
Sweden	4

Sectors

Sector	Claims in 60 days
Technology	20
Healthcare	19
Manufacturing	19
Other	12
Professional Services	12
Government & Defense	10
Education	8
Retail & E-Commerce	6

Reported techniques

Valid Accounts External Remote Services Exploit Public-Facing Application Phishing Windows Management Instrumentation Command and Scripting Interpreter Software Deployment Tools Create Account Create or Modify System Process Boot or Logon Autostart Execution Exploitation for Privilege Escalation Forced Authentication Adversary-in-the-Middle Obfuscated Files or Information Indicator Removal OS Credential Dumping Brute Force Unsecured Credentials Credentials from Password Stores Remote System Discovery Network Service Discovery Permission Groups Discovery Account Discovery Domain Trust Discovery Cloud Service Discovery Remote Services Remote Service Session Hijacking Data from Local System Data from Network Shared Drive Data Staged Email Collection Exfiltration Over Alternative Protocol Transfer Data to Cloud Account Application Layer Protocol Proxy Remote Access Tools Protocol Tunneling Encrypted Channel Data Encrypted for Impact Service Stop

Ransomware tracker