Ransomware.live: thegentlemen

| Active | RaaS

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Victims

416

First Discovered

2025-09-09

victim

Last Discovered

2026-05-15

victim

Inactive Since

days

Avg Delay

96.0

days

Infostealer

26.1%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

-41% vs last month

Known Locations (1)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
	Gentlecloud Protection		Yes	2026-05-15T17:48:04	nginx	`tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
ADFind BloodHound Censys CertiHound MANSPIDER PowerZure Shodan gogo scanner ldapdomaindump placeholder placeholder	AnyDesk placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	EDRStartupHinder GFreeze GLinker placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	DumpBrowserSecrets Hydra KslDump KslKatz XenAllPasswordPro placeholder placeholder placeholder placeholder placeholder placeholder	Custom Go Locker (Windows/Linux/NAS) NetExec (nxc) PetitPotam PrivHound RegPwn RelayKing Responder TrustedSec Titanis Velociraptor ZeroPulse ntlmrelayx	Chisel-ng ProxyChains Tor / Onion C2 openconnect placeholder placeholder placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	rclone placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder

TTPs Matrix (12)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid Accounts	Windows Management Instrumentation	Create Account	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping	Remote System Discovery	Remote Services	Data from Local System	Exfiltration Over Alternative Protocol	Application Layer Protocol	Data Encrypted for Impact
Valid Accounts: Domain Accounts	Command and Scripting Interpreter	Create or Modify System Process	Forced Authentication	Indicator Removal	Brute Force	Network Service Discovery	Remote Services: Remote Desktop Protocol	Data from Network Shared Drive	Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol: Web Protocols	Service Stop
External Remote Services	Command and Scripting Interpreter: PowerShell	Boot or Logon Autostart Execution	Adversary-in-the-Middle	Proxy	Unsecured Credentials	Permission Groups Discovery	Remote Services: SMB/Windows Admin Shares	Data Staged	Transfer Data to Cloud Account	Remote Access Software	Inhibit System Recovery
Exploit Public-Facing Application	Command and Scripting Interpreter: Windows Command Shell			Modify Registry	Credentials from Password Stores	Account Discovery	Remote Services: SSH	Data Staged: Local Data Staging		Protocol Tunneling	Defacement
Phishing	Software Deployment Tools			Domain Policy Modification: Group Policy Modification		Account Discovery: Domain Account	Remote Service Session Hijacking	Email Collection		Encrypted Channel
				Impair Defenses		Domain Trust Discovery
				Impair Defenses: Disable or Modify Tools		Cloud Service Discovery

YARA Rules (1)

Indicators of Compromise (IoCs) (7)

Hash SHA1 4 session 1 tox 2

Type	IOC
`Hash SHA1`	`c0979ec20b87084317d1bfa50405f7149c3b5c5f`
`Hash SHA1`	`c12c4d58541cc4f75ae19b65295a52c559570054`
`Hash SHA1`	`df249727c12741ca176d5f1ccba3ce188a546d28`
`Hash SHA1`	`e00293ce0eb534874efd615ae590cf6aa3858ba4`
`session`	`05809b2da1d5b1a302f48b5767fd1843d54f3c516f9ab0eb26b544ffa73340292e`
`tox`	`98C132E2B20B531BE6604397D97040C1E9EB42FCE12EDF119BCE8B4031CA5C70DAF5E65FA3C3`
`tox`	`F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E`

Thegentlemen

| Active | RaaS

Attack Velocity — Last 12 months