Skip to content
Gentlemen Ransomware Targets Global Industries Amid LLM Integration

Gentlemen Ransomware Targets Global Industries Amid LLM Integration

First seen 17 Dec 2025, 07:58 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

The Gentlemen ransomware operation has affected at least 17 countries across the Americas, Asia-Pacific, and the Middle East, targeting sectors such as manufacturing, healthcare, construction, and insurance. This operation employs a double extortion model and utilizes various evasion techniques, including the deactivation of Windows Defender. Concurrently, the integration of Large Language Models into ransomware operations is facilitating the creation of Ransomware-as-a-Service, lowering entry barriers for cybercriminals.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 227d ago How this analysis works

More articles in this cluster (26)

Following this threat?

Track Gentlemen and CVE-2025-55182 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed