The Gentlemen
Unknown Active
- Mentions
- 3
- First seen
- 11 Jun 2026
- Last seen
- 29 Jun 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Defender for Endpoint
- Threat focus:
- ransomwareindustrial / ot espionage
- Sector / region:
- Manufacturing
Origin
Unattributed
Profile
The Gentlemen is a Ransomware-as-a-Service group known for using custom backdoors and evolving tactics. They employ the GentleKiller EDR framework to disable up to 400 security processes. Their ransomware spreads like a worm and has claimed 478 victims.
Affected vendors
CrowdStrikeMicrosoft DefenderVarious security vendors (via impersonation)
Associated malware / tools
The Gentlemen RansomwareGentleKillerCustom backdoorGentlemen Ransomware
Related actors
Share a CVE, technique or malware with this actor.