RaqibCTI ⌘K
The Gentlemen · Ransomware · RaqibCTI
Knowledge / Actors / The Gentlemen Corpus Attribution
RaaS (financially motivated, unattributed)
Motivation
Financially motivated (ransomware)
Attribution confidence
medium
MENA targeting
Saudi Arabia, UAE
Sectors
Construction, power, manufacturing, engineering consultancy
Corpus activity · 6mo 2 mentions
Jul 2026: 1 Sep 2026: 1 A M J J A S
Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Why it matters Ransomware actor, medium confidence, documented targeting Saudi Arabia, UAE (Construction, power, manufacturing sectors).
What's next No pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Coverage robustness · vs this actor How evasion-resistant our detection coverage is against The Gentlemen's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.
Techniques with a robust rule
0%
Techniques with any detection
6 / 6
Mean robustness (of covered)
2.2
Known tooling · Ransomware Tool Matrix Tools observed in intrusions leading to The Gentlemen's ransomware, per the community Ransomware Tool Matrix — observed use, not exhaustive. Snapshot 2026-08-07.
actor
Technique overlap
← Meow actor Technique overlap ← Nova actor Technique overlap ← Tengu actor Technique overlap ← Gunra actor Technique overlap ← Monti actor Technique overlap ← 8Base actor Technique overlap ← Lynx actor Technique overlap ← Cl0p actor Technique overlap 4 source reports · latest 15 May 2026
Claimed victims · 38 tracked Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches . Metadata only. MENA Ransomware Watch →
Claim volume · last 12 months
Feb 2026: 7 Mar 2026: 2 Apr 2026: 3 May 2026: 6 Jun 2026: 5 Jul 2026: 5 Aug 2026: 6 Sep 2026: 4 O N D J F M A M J J A S
Date Victim Country Sector 2026-09-15 Ardom Eilot Israel — 2026-09-14 Ardom Eilot Israel — 2026-09-07 Yapı Merkezi Türkiye Manufacturing 2026-09-07 Nile Projects Trading Egypt Other 2026-08-31 Saudi Consulting Services SAUD CONSULT Saudi Arabia Professional Services 2026-08-22 Meridian Logistics Group Saudi Arabia — 2026-08-21 AWJ Holding UAE — 2026-08-21 Almeer UAE Other 2026-08-14 Avanta Maroc Ex Adecco Morocco Professional Services 2026-08-10 AIMS Group UAE — 2026-07-31 Salem Saleh Babgi Saudi Arabia — 2026-07-31 Efrata College of Education Israel Education
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
Country Japan co-mentioned in 1 item CVE CVE-2025-24799 co-mentioned in 1 item Sector Manufacturing co-mentioned in 1 item Malware LockBit 5.0 co-mentioned in 1 item Country Taiwan co-mentioned in 1 item Sector professional, scientific, and technical services co-mentioned in 1 item CVE CVE-2025-2479 co-mentioned in 1 item Sector Construction co-mentioned in 1 item Sector educational services co-mentioned in 1 item Sector wholesale trade co-mentioned in 1 item Malware RustHound co-mentioned in 1 item Malware Stormous co-mentioned in 1 item
Country United States co-mentioned in 1 item
Malware NetRunner co-mentioned in 1 item
Sector transportation and warehousing co-mentioned in 1 item
Malware NightSpire co-mentioned in 1 item
Malware RansomEXX co-mentioned in 1 item
Sector retail trade co-mentioned in 1 item
Malware SafePay co-mentioned in 1 item
Malware Qilin co-mentioned in 1 item
Sector information and communications co-mentioned in 1 item
Sector health care/social assistance co-mentioned in 1 item
Malware impacket-partial-mic co-mentioned in 1 item
CVE CVE-2020-1472 co-mentioned in 1 item
Sector services co-mentioned in 1 item
Country Philippines co-mentioned in 1 item
Malware The Gentlemen co-mentioned in 1 item
Malware AiLock co-mentioned in 1 item
Sector finance and insurance co-mentioned in 1 item
Malware Responder co-mentioned in 1 item