The Gentlemen is a financially motivated ransomware group that first emerged in mid-2025 and rapidly evolved into a significant threat actor, initially operating as a closed group before transitioning to a Ransomware-as-a-Service (RaaS) model in September 2025, actively recruiting affiliates with a high revenue share. The group is assessed with high confidence to be of Russian-speaking origin, with its leader identified as Alexander Andreevich Yapaev (LARVA-368), who is known to avoid targeting Commonwealth of Independent States (CIS) countries. What distinguishes The Gentlemen is its rapid operational scaling, high technical maturity, and adaptive tooling, including the use of artificial intelligence in ransomware development. They employ a double-extortion strategy, encrypting victim systems and exfiltrating sensitive data, which they then publish on their dedicated leak site to coerce ransom payments. The group maintains a substantial database of pre-compromised FortiGate appliances

Aliases del actor

The Gentlemen Ransomwarethe gentlemen

Actores similares

the-gentlemenactor · 70brotherhoodransomware · 3againstthewestransomware · 2leaktheanalystransomware · 2prometheusransomware · 2thegreenbloodgroupransomware · 2other-actorsactor · 72the-green-blood-groupactor · 2Adversary-in-the-Middleactor · 1Pluggable Authentication Modulesactor · 1

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker