thegentlemen

Profile

The Gentlemen is a RaaS group that emerged in July - August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 · Valid AccountsT1078.002 · Valid Accounts: Domain AccountsT1133 · External Remote ServicesT1190 · Exploit Public-Facing ApplicationT1566 · Phishing

Execution

T1047 · Windows Management InstrumentationT1059 · Command and Scripting InterpreterT1059.001 · Command and Scripting Interpreter: PowerShellT1059.003 · Command and Scripting Interpreter: Windows Command ShellT1072 · Software Deployment Tools

Persistence

T1136 · Create AccountT1543 · Create or Modify System ProcessT1547 · Boot or Logon Autostart Execution

Privilege Escalation

T1068 · Exploitation for Privilege EscalationT1187 · Forced AuthenticationT1557 · Adversary-in-the-Middle

Defense Evasion

T1027 · Obfuscated Files or InformationT1070 · Indicator RemovalT1090 · ProxyT1112 · Modify RegistryT1484.001 · Domain Policy Modification: Group Policy ModificationT1562 · Impair DefensesT1562.001 · Impair Defenses: Disable or Modify Tools

Credential Access

T1003 · OS Credential DumpingT1110 · Brute ForceT1552 · Unsecured CredentialsT1555 · Credentials from Password Stores

Discovery

T1018 · Remote System DiscoveryT1046 · Network Service DiscoveryT1069 · Permission Groups DiscoveryT1087 · Account DiscoveryT1087.002 · Account Discovery: Domain AccountT1482 · Domain Trust DiscoveryT1526 · Cloud Service Discovery

Lateral Movement

T1021 · Remote ServicesT1021.001 · Remote Services: Remote Desktop ProtocolT1021.002 · Remote Services: SMB/Windows Admin SharesT1021.004 · Remote Services: SSHT1563 · Remote Service Session Hijacking

Collection

T1005 · Data from Local SystemT1039 · Data from Network Shared DriveT1074 · Data StagedT1074.001 · Data Staged: Local Data StagingT1114 · Email Collection

Exfiltration

T1048 · Exfiltration Over Alternative ProtocolT1048.001 · Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1537 · Transfer Data to Cloud Account

Command and Control

T1071 · Application Layer ProtocolT1071.001 · Application Layer Protocol: Web ProtocolsT1219 · Remote Access SoftwareT1572 · Protocol TunnelingT1573 · Encrypted Channel

Impact

T1486 · Data Encrypted for ImpactT1489 · Service StopT1490 · Inhibit System RecoveryT1491 · Defacement