Skip to main content
Darkfield

Operator dossier

thegentlemen (also tracked as the gentlemen) is a ransomware operator currently active on public leak sites. Darkfield has indexed 599 public victims claimed by this operator between September 9, 2025 and July 11, 2026. thegentlemen is a ransomware group that emerged in September 2025, operating with apparent financial motivations based on their broad targeting of commercial sectors. The group has documented 267 victims across multiple countries, with primary focus on the United States, Thailand, France, Brazil, and India. Their targeting strategy demonstrates a preference for high-value sectors including manufacturing, technology, healthcare, and financial services organizations. Given the group's recent emergence and limited public documentation from established threat intelligence sources such as CISA, FBI, or major security research firms, specific details regarding their country of origin, operational structure, attack methodologies, encryption techniques, and whether they employ ransomware-as-a-service models remain unclear. The relatively high victim count of 267 in a short operational timeframe since September 2025 suggests either an aggressive campaign pace or potential inflation of victim numbers through affiliate operations, though without corroborating intelligence reports, the group's exact operational capabilities and notable campaigns cannot be definitively established. Current intelligence indicates the group remains active as of late 2025, though comprehensive threat profiling requires additional validated reporting from authoritative cybersecurity sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by thegentlemen

Most recent 150 of 599 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for thegentlemen →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

thegentlemen

aka the gentlemen · 599 victims indexed · first seen 10 months ago · last activity 4 days ago

599
Victims indexed
#19 of 364 tracked operators
10m
Active period
Sep 2025 → Jul 2026
10
Countries hit
top US · 27

At a glance

Status
active
Aliases
the gentlemen
First seen
10 months ago
Last activity
4 days ago
Onion sites
1 known endpoint
Primary sector
Not Found · 115 hits

About

thegentlemen is a ransomware group that emerged in September 2025, operating with apparent financial motivations based on their broad targeting of commercial sectors. The group has documented 267 victims across multiple countries, with primary focus on the United States, Thailand, France, Brazil, and India. Their targeting strategy demonstrates a preference for high-value sectors including manufacturing, technology, healthcare, and financial services organizations. Given the group's recent emergence and limited public documentation from established threat intelligence sources such as CISA, FBI, or major security research firms, specific details regarding their country of origin, operational structure, attack methodologies, encryption techniques, and whether they employ ransomware-as-a-service models remain unclear. The relatively high victim count of 267 in a short operational timeframe since September 2025 suggests either an aggressive campaign pace or potential inflation of victim numbers through affiliate operations, though without corroborating intelligence reports, the group's exact operational capabilities and notable campaigns cannot be definitively established. Current intelligence indicates the group remains active as of late 2025, though comprehensive threat profiling requires additional validated reporting from authoritative cybersecurity sources.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

7 months
2025-09-01T00:00:00+00:00 · 382025-10-01T00:00:00+00:00 · 102025-11-01T00:00:00+00:00 · 202025-12-01T00:00:00+00:00 · 132026-01-01T00:00:00+00:00 · 472026-02-01T00:00:00+00:00 · 892026-03-01T00:00:00+00:00 · 50
2025-09-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
27
🇹🇭 Thailand
14
🇫🇷 France
12
🇧🇷 Brazil
10
🇮🇳 India
9
🇩🇪 Germany
8
🇬🇧 United Kingdom
7
🇪🇸 Spain
7
United States dossier →Thailand dossier →France dossier →Brazil dossier →

Top sectors

Manufacturing
32
Technology
25
Healthcare
17
Financial Services
16
Education
12
Transportation/Logistics
11
Energy
8
Consumer Services
7
Manufacturing dossier →Technology dossier →Healthcare dossier →Financial Services dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion

Source

Updated 4 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time thegentlemen posts a victim.

Add thegentlemen to your watchlist — Pro pings you within 5 minutes of any new thegentlemen leak-site post, Telegram callout, or affiliate-rebrand inference.