Back Cybersecuritynews

Exposed Server Reveals TheGentlemen Ransomware Toolkit, Victim Credentials, and Ngrok Tokens

Cybersecuritynews •Tushar Subhra Dutta • March 30, 2026

A misconfigured server hosted on a Russian bulletproof hosting provider has exposed the complete operational toolkit of a TheGentlemen ransomware affiliate, including harvested victim credentials and plaintext authentication tokens used to establish hidden remote access tunnels. TheGentlemen ransomware group operates as a Ransomware-as-a-Service, or RaaS, operation where affiliates carry out attacks using shared tools and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Toolkit Exposed: TheGentlemen Affiliate's Operations Uncovered Researchers found an exposed server on a Russian bulletproof hosting provider containing a complete ransomware toolkit linked to TheGentlemen affiliate. The toolkit includes various utilities for credential dumping, remote access, and defense evasion, along with plaintext ngrok tokens and victim credentials. The investigation revealed 126 files cataloged, including tools for privilege escalation and scripts for disabling security measures. TheGentlemen operates as a Ransomware-as-a-Service (RaaS), allowing affiliates to conduct attacks with shared resources. Analysts have mapped the toolkit components to MITRE ATT&CK techniques, emphasizing the need for defenders to monitor specific behaviors. Recommendations include blocking outbound connections to the identified IP and enforcing application whitelisting. Immediate incident response actions are advised upon detection of the toolkit's use. 3 sources 73

Extracted Entities

Exposed Server Reveals TheGentlemen Ransomware Toolkit, Victim Credentials, and Ngrok Tokens

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (1)

Tools (1)