The Gentlemen
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:25:25
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Targeted regions: country_code:cn country_code:jp country_code:au
Context
The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption methods based on file size. The group targets medium to large organizations across various sectors, particularly in the Asia-Pacific region, and has demonstrated a high level of technical maturity and operational discipline. Their activities include systematic compromise of enterprise environments, mass account enumeration, and the use of encrypted channels for data exfiltration.
Reports & references
- socradar.io — Dark Web Profile The Gentlemen Ransomware (report)
- Trend Micro — Unmasking The Gentlemen Ransomware (report)
- cybereason.com — The Gentlemen Ransomware (report)
- sprocketsecurity.com — Tracing A Threat Actors Footprints On Tor (report)