Ransomware group
Thegentlemen ransomware: victims and leak site activity
The Thegentlemen ransomware group has listed 837 victims on its leak site since September 2025; its latest post is from 9 September 2026. Most affected countries: United States, Germany and Thailand. Most targeted sector: Manufacturing.
Total posts
837
First seen
2025-09-09
Latest post
2026-09-09
Countries hit
86
About Thegentlemen
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.
- Also known as
- Storm-2697
- Leak site (Tor)
- http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion
Most targeted countries
- United States 152
- Germany 39
- Thailand 39
- France 37
- United Kingdom 36
- India 32
- Brazil 31
- Italy 31
- Taiwan 22
- Poland 21
Most targeted sectors
- Manufacturing 166
- Technology 109
- Professional Services 106
- Healthcare 73
- Retail & E-Commerce 66
- Transportation 50
- Agriculture and Food Production 46
- Financial Services 43
- Government & Defense 32
- Energy & Utilities 29