The Gentlemen

Oct 22 – October 25, 2026 · 2 reports

• SOCRadar mapped an exposed AI intrusion ecosystem used by INC and The Gentlemen ransomware affiliates. The framework, called Phantom, runs on OpenCode with OpenRouter-hosted commercial models under an "AI-executed, human-approved" structure: a human supplies a victim-specific prompt and reviews each step. An open directory at 45.227.254.43 logged 8,257 messages across 133 sessions. When models refused a request, the operator rewrote it as an authorised red-team assessment rather than switching models. Exploitation records name CVE-2024-57727 (SimpleHelp), CVE-2026-35616 (FortiClient EMS), and CVE-2026-41940 (cPanel/WHM) as actively exploited, with SonicWall, WordPress, LiteLLM and Drupal bugs staged or developed. In one case a single reused password unlocked VPN, servers, RMM, backup and security management platforms at once. (The Hacker News) · Oct 25 · observed · as inc · Threat Activity
• Exposed operator environments also tie AI to ransomware affiliates and lower-skill cybercrime. SOCRadar says seven servers linked to INC and The Gentlemen contained 8,257 messages across 133 OpenCode sessions, covering 62 targeted organizations and more than $23,920 in AI-service spending; targets are not confirmed breaches. Separately, Unit 42 says BUGSTER ran Hermes Agent with DeepSeek V4 safety controls disabled and confirmed exfiltration of more than 5,200 student PII records from a second Indian university. Both describe AI-assisted operations, not hands-off autonomy. · Oct 22 · observed · via ai agent · as inc, bugster · Cloud, Identity & Threat Activity

Oct 10 – October 13, 2026 · 2 reports

• Leak-site volume: The Gentlemen added 10 victims with countdown timers and no samples yet, including Deloitte, KFC, MoneyGram, Confluent, BigID and the Royal Thai Air Force (@DailyDarkWeb); n0n posted 32 victims heavily concentrated in ports and shipping — Ocean Network Express, Santos Brasil, TTI Algeciras and HPC Hamburg Port Consulting among them (@FalconFeedsio). · Oct 13 · claimed · as n0n · Threat Intelligence
• Deloitte has been named on The Gentlemen's leak site, with the group threatening publication in 9–10 days. Unverified, and no scope or TTPs disclosed (Dark Web Informer). · Oct 10 · claimed · Ransomware & Law Enforcement

September 10, 2026

• The Gentlemen claimed Air Canada on its leak site with a 9–10 day publication threat (DarkWebInformer), and Veradigm disclosed a patient data breach at a third-party vendor after the same gang claimed it, saying access was limited to a specific interface and did not reach its networks, servers or databases (BleepingComputer, The Record). · Sep 10 · claimed · Malware & Threat Activity

September 8, 2026

• Leak-site volume held over the weekend at roughly 7–10 new victim postings captured for 6 September (Daily Dark Web). The Gentlemen posted 18 victims in one batch, including Los Angeles Metro and Danish firm Domis (FalconFeeds); Storm added four Canadian manufacturers and service firms (FalconFeeds). · Sep 8 · observed · as storm · Threat Activity

Jun 17 – July 24, 2026 · 7 reports

• Ransomware roundup: The Gentlemen listed 31 victims including a Vienna IVF clinic (Wunschkind Klinik Dr. Brunbauer) and US biotech MatTek (DarkWebInformer); PLAY claimed Restaurant Depot and Spanish rental firm Record Go (DarkWebInformer). · Jul 24 · observed · as play · Threat Activity
• Ransomware roundup: Qilin claimed eight new victims including a Bay Area private school and a Mississippi catfish processor (DarkWebInformer); The Gentlemen listed Colombian oil-and-gas firm Ecopetrol and the U.S. Navy's Military Sealift Command (FalconFeeds); LockBit 5.0 added six victims across India, Singapore, Argentina and the UK (FalconFeeds). · Jul 19 · claimed · as qilin, lockbit · Threat Activity
• Unit 42 profiled The Gentlemen, a high-tempo RaaS operation evolved from Qilin that leans on sophisticated tooling and zero-day exploits; the group's leak site claimed 18 new victims across construction, finance, pharma, and physical-security sectors worldwide. Unit 42, Dark Web Informer · Jul 12 · claimed · as qilin · Threat Activity
• Qilin continues to lead the 2026 ransomware landscape by volume (708 tracked attacks), ahead of The Gentlemen, Akira, INC, and DragonForce. DarkFeed via Ido Cohen · Jul 11 · none · as qilin, akira, inc, dragonforce · Threat Intelligence
• The Gentlemen (Storm-2697) — Unit 42 identified a C-based ransomware variant tied to the crew, with a leak-site countdown-style ransom note. Unit 42 · Jul 9 · observed · as storm 2697 · Threat Activity
• The Gentlemen ransomware exploited a zero-day in a signed Kontron driver to disable endpoint defenses via classic BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware, per Expel's analysis. Recommended mitigations include driver blocklisting, VBS, and WDAC. The group has been active this week, adding roughly 20 new victims to its leak site including EMS provider Medic Rescue and German meat giant Tönnies (Expel). · Jul 6 · observed · Vulnerabilities & Exploits
• The Gentlemen, a RaaS operation that ramped up in early 2026, is profiled by Kaspersky/Securelist for its custom backdoors and rapidly evolving TTPs. Securelist · Jun 30 · none · Threat Activity

Jun 19 – June 21, 2026

• INC has grown into one of 2026's most prolific RaaS operations with 830+ victims since August 2023, absorbing affiliates after the LockBit and BlackCat disruptions (The Hacker News). Current leaderboard tracking puts Qilin at 651 attacks, The Gentlemen at 430, and Akira at 282 (DarkFeed). · Jun 21 · observed · as inc, qilin, akira · Ransomware & EDR Evasion

June 17, 2026

• The Gentleman ransomware passed ~500 claimed victims, adding a European national healthcare org and one of Scandinavia's most recognized national museums — worth flagging for Nordic exposure tracking. Ido Cohen. · Jun 17 · observed · as the gentleman · Data Breaches & Extortion