Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
The Gentlemen is a ransomware group first documented in August 2025, characterized by custom tooling, targeted defense-evasion techniques, and a self-propagating Go-based encryptor.
The Gentlemen was first observed in August 2025 by Trend Micro during an active campaign, with no prior threat-intelligence footprint. Its leak site went live around early September 2025. The operation began as a closed group and started offering RaaS to affiliates in September 2025. Researchers highlight advanced, target-tailored defense-evasion tradecraft (custom anti-AV/anti-EDR tooling adapted mid-campaign) rather than generic techniques. In May 2026 Microsoft published analysis of a self-propagating Go-based Gentlemen encryptor.
Reporting through mid-2026 (e.g., Ransomware.live tracking) credits The Gentlemen with a rapidly growing victim count across many countries and sectors, with manufacturing, construction, healthcare and insurance among the hardest hit and an initial concentration in the Asia-Pacific region before broader expansion.
The Gentlemen has claimed victims in Saudi Arabia and the UAE among its listings. These are extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.
+44 more relationships — see the relationships browser.
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.