The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
Source Reddit NetSec
Discussion
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation Source: https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/
r/netsec (opens in a new tab)u/acronis0 points0 comments
Our Threat Research Unit published a breakdown of “The Gentlemen” - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research:
- They’re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards
- Claimed 800+ victims across the US and Europe, making them one of the top RaaS groups this year
- Cross-platform ransomware variants targeting Windows, Linux, NAS, and BSD
- Active use of EDR-killing tooling - one recent incident involved a custom dropper abusing vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers (BYOVD)
- A breach of the group’s own infrastructure gave researchers rare visibility into their affiliate network, tooling, and ties to the broader ransomware ecosystem
Full technical writeup linked below for anyone who wants to dig into the IOCs and affiliate details.
https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/