Mastodawn

Eric Marsh Jun 10

New and scoopy, by me: Who Runs the Ransomware Group 'The Gentlemen?'

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/

#thegentlemen #ransomware #cybercrime #breadcrumbs

BrianKrebs Jun 10

Dayum. The folks at PRODAFT have now dropped one helluva detailed writeup on The Gentlemen. tl;dr:

-The administrator supplies affiliates with initial access directly, primarily Fortinet SSL-VPN credentials obtained through brute-force attacks or sourced from the group's own leak database.

-The administrator is using AI to develop and maintain the ransomware and associated tooling, as well as to assist with post-exploitation activity.

-The group's RaaS offering provides affiliates with five locker variants (Windows, Linux, ESXi, a legacy Windows XP+ build, and LVM), along with usage instructions.

https://catalyst.prodaft.com/public/report/inside-the-phantom-mantis-operation/overview#paragraph-1077|172

PRODAFT CATALYST

Explore CATALYST by PRODAFT, a cyber threat intelligence platform for tracking threat actors, analyzing cybercrime activity, and delivering real-time, actionable security insights.

BrianKrebs Jun 11

It will be interesting to see how The Gentlemen respond to having their dear overlord identified in real life. Already there is some butthurt on the group's threads across a couple of RU hacker forums.

One thing I didn't mention in the story is the potential consequences of top RU hackers being outed. At a minimum, those tend to include having one's accounts on the major forums deleted. Sure, the person can just create a new identity and resurface, but from then on they suddenly have several more concerns to deal with on a regular basis, such as interference and shakedowns from tax authorities and local police, extortion or even kidnapping for their considerable ill-gotten crypto wealth.

What's remarkable is that this guy isn't the only major ransomware head honcho who was too careless with their personal information. Stay tuned.

@briankrebs Thanks for the update! I’m curious also about how the story plays out.

@briankrebs thank you so much for this update

@briankrebs "Who is this gentleman, Dude?"

i give up ever having animated gifs work ever again.

stand a little out of my sun 🍉Jun 10

@briankrebs 90%, in this economy?! Are they still taking applications?

BrianKrebs Jun 10

@fiend_unpleasant probably. but only if you're a native RU speaker or speak it fluently.

stand a little out of my sun 🍉Jun 10

@briankrebs Damn, I can barely speak English, and I've been at it for nearly 40 years.

Oh well, I guess I will have to stick to making an honest living, like a sucker.

Dr. Christopher Kunz Jun 10

@briankrebs As a tiny linguistic explanation to the "4 = shorthand for the ch sound" thing for interested readers: four is "chetyrie" and the first letter of that word looks like this: ч
Also commented that on the blog.

Cybarbie Jun 10

@briankrebs Wouldn't it be funny if AI generated images had a watermark containing the client ip address that generated the image. How we'd laugh!

@nf3xn why ip only? Dox them all the way!

Cybarbie Jun 10

@labria True some other more definitive marker would be better. I only wanted to borrow a few pixels, make sure it survived image processing and be sneaky, very very sneaky.

Dud and Forgotten.Jun 10

@nf3xn @briankrebs or hide it in metadata

Mark Koek Jun 10

@briankrebs great reporting as always

Walrus 🏴󠁧󠁢󠁷󠁬󠁳󠁿Jun 11

I would contribute to their crowdfunder if they could take Palantir down. 😎

chris actual Jun 11

CyberDude Jun 12

@briankrebs are there samples of their ransomware?