The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms.
The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption methods based on file size. The group targets medium to large organizations across various sectors, particularly in the Asia-Pacific region, and has demonstrated a high level of technical maturity and operational discipline. Their activities include systematic compromise of enterprise environments, mass account enumeration, and the use of encrypted channels for data exfiltration.
FTAPI, a Munich secure file-transfer vendor used by 2,000+ organisations, confirmed attackers breached one internal server and deployed ransomware after The Gentlemen gang listed it as a victim.
German data-exchange provider FTAPI confirmed ransomware hit one internal server after The Gentlemen's leak-site claim; it says its platform and customer data were unaffected.
Healthcare technology firm Veradigm disclosed that attackers used credentials stolen from a third-party vendor to reach a customer-service API and copy patient data, after The Gentlemen ransomware gang claimed to hold roughly 3.5 million records.
U.S. hospital and healthcare-facilities operator Nutex Health confirmed in an SEC filing that patient, employee, provider and financial information was accessed and exfiltrated in an August cyberattack claimed by the ransomware-as-a-service group The Gentlemen.
AnMed, a nonprofit health system in upstate South Carolina, said a malware attack forced it to close more than 80 facilities, with the ransomware group The Gentlemen linked to the incident.
Spanish defense and technology group Indra confirmed a ransomware attack on one of its subsidiaries after The Gentlemen ransomware gang listed the company on its leak site, saying the impact was minimal and limited to a non-critical environment.
Australia's second-largest raw sugar producer, Mackay Sugar, shut down milling and cane haulage at two North Queensland mills after a ransomware attack at the start of the crushing season; The Gentlemen group later claimed the attack.