Socprime The Gentlemen Ransomware Group Targets Organizations with Aggressive Tactics
Article Content
- •The Gentlemen RaaS group has claimed over 800 victims since mid-2025.
- •They utilize a double-extortion model, threatening to publish stolen data.
- •Custom EDR-killing tools exploit vulnerable drivers to evade detection.
The Gentlemen is a Russian-speaking Ransomware-as-a-Service (RaaS) group that emerged in mid-2025, reportedly splitting from LockBit and Qilin. They employ a double-extortion model, encrypting data and threatening to publish stolen information. The group has claimed over 800 victims across the US and Europe, targeting Windows, Linux, NAS, and BSD systems. Their operations include custom EDR-killing tools that exploit vulnerable drivers. A breach of their infrastructure revealed details about their affiliate network and operational tactics. Organizations are advised to implement EDR/XDR solutions and maintain updated systems to mitigate risks. Immediate isolation of affected systems is recommended upon detection of their activity.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track The Gentlemen in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What systems are affected by The Gentlemen ransomware?
How many victims have been reported?
What should organizations do to protect themselves?
Continue Reading
Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin… 
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure…