thegentlemen

thegentlemen operates an affiliate-based ransomware model, with evidence of a complete toolkit linked to an affiliate and including utilities for credential dumping, remote access, and defense evasion, along with plaintext ngrok tokens and victim credentials. Victims total about 700, spanning Manufacturing, Technology, Healthcare, Business Services, and Financial Services, with the United States, France, Germany, the United Kingdom, and Thailand most frequently affected. Recent reporting shows an affiliate-linked operation illustrated by an exposed ransomware toolkit found on a Russian bulletproof hosting provider, highlighting the included credential-dumping, remote-access, and defense-evasion tools alongside exposed victim credentials. Across the reporting, the pattern suggests affiliate deployment and shared tooling rather than a single in-house operation.

Sectors: Manufacturing, Technology, Healthcare · Countries: US, FR, DE