Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Hunt / thegentlemen

The Gentlemen

G1058 The GentlemenS9051 The Gentlemen Ransomware

363victims, 90d
Nov 5last post
2reports about them
54/64techniques with a rule
0indicators

Who they hit

  • Unclassified73
  • Manufacturing59
  • Healthcare46
  • Technology46
  • Retail & consumer38
  • Professional services29
  • US91
  • GB24
  • BR19
  • DE14
  • CA14
  • IT13
PostedVictimCountrySector
2026-11-05KABS Pharmaceutical ServicesGBHealthcare
2026-11-05Solutis TecnologiasBRTechnology
2026-11-05Grupo LorrioESManufacturing
2026-11-05McEwan Fraser LegalGBProfessional services
2026-11-05Hausarztpraxis RiesDEHealthcare
2026-11-05Lighting DirectNZRetail & consumer
2026-11-05RedBlink TechnologiesCATechnology
2026-11-05Coemi ImóveisBRRetail & consumer
2026-11-05LabatecCHManufacturing
2026-11-05Antwerp House DentalGBHealthcare
2026-11-05Logsytech GroupFRTechnology
2026-11-05Secretaria de Estado de SaúdeBRGovernment

Latest 12 of 363, from ransomware.live. These are the group's claims.

Confirmed elsewhere

Victims of The Gentlemen that a second, independent source also named inside two weeks. How convergence works.

Reports about them

Also named in passing in 20 more: Unit 42, Kaspersky Securelist, ReliaQuest, ReliaQuest, ReliaQuest, ReliaQuest, Intel 471, ReliaQuest, Cisco Talos, Unit 42, AhnLab ASEC, Check Point Research, Cisco Talos, Group-IB, AhnLab ASEC, Intel 471, Recorded Future Insikt, Check Point Research, Intel 471, Group-IB. Those don't feed the techniques or indicators below.

What they exploit

CVEProductKEVEPSS
CVE-2021-26855Microsoft Exchange Serveryes, ransomware use1.000
CVE-2023-27532Veeam Backup & Replicationyes, ransomware use0.806
CVE-2024-4345-no0.015
CVE-2025-68947-no0.001
CVE-2026-20131Cisco Secure Firewall Management Center (FMC)yes, ransomware use0.444

What they do

70 techniques, in kill-chain order. 10 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

IDTechniqueSourceSigmaHQStatus
T1583.001 Domains mitre their side
T1585 Establish Accounts mitre their side
T1585.001 Social Media Accounts mitre their side
T1588.002 Tool mitre 9 their side
T1683.001 Written Content mitre their side
T1683.002 Audio-Visual Content mitre their side
T1078 Valid Accounts mitre 55 SigmaHQ
T1190 Exploit Public-Facing Application mitre report 147 thrunt
T1047 Windows Management Instrumentation mitre 52 SigmaHQ
T1053.003 Cron mitre 6 SigmaHQ
T1053.005 Scheduled Task mitre 51 SigmaHQ
T1059 Command and Scripting Interpreter report 94 thrunt
T1059.001 PowerShell mitre report 220 SigmaHQ
T1059.003 Windows Command Shell mitre report 46 SigmaHQ
T1059.004 Unix Shell report 18 SigmaHQ
T1059.012 Hypervisor CLI mitre 9 SigmaHQ
T1106 Native API mitre 14 SigmaHQ
T1204 User Execution report 10 SigmaHQ
T1569.002 Service Execution mitre 43 SigmaHQ
T1675 ESXi Administration Command mitre nothing
T1037.003 Network Logon Script mitre nothing
T1037.004 RC Scripts mitre nothing
T1112 Modify Registry mitre 94 SigmaHQ
T1505.003 Web Shell report 34 thrunt
T1543.003 Windows Service mitre 47 SigmaHQ
T1547.001 Registry Run Keys / Startup Folder mitre 39 SigmaHQ
T1068 Exploitation for Privilege Escalation mitre 30 SigmaHQ
T1484.001 Group Policy Modification mitre 6 SigmaHQ
T1018 Remote System Discovery mitre 17 SigmaHQ
T1082 System Information Discovery report 33 SigmaHQ
T1083 File and Directory Discovery mitre 24 SigmaHQ
T1135 Network Share Discovery mitre 7 SigmaHQ
T1482 Domain Trust Discovery mitre 17 SigmaHQ
T1680 Local Storage Discovery mitre nothing
T1021.001 Remote Desktop Protocol mitre 16 SigmaHQ
T1021.002 SMB/Windows Admin Shares mitre 38 SigmaHQ
T1005 Data from Local System report 14 SigmaHQ
T1074.001 Local Data Staging mitre 4 SigmaHQ
T1071.001 Web Protocols report 42 SigmaHQ
T1090 Proxy mitre 22 SigmaHQ
T1105 Ingress Tool Transfer report 87 thrunt
T1219.002 Remote Desktop Software mitre 46 SigmaHQ
T1041 Exfiltration Over C2 Channel report 5 SigmaHQ
T1486 Data Encrypted for Impact mitre 16 SigmaHQ
T1489 Service Stop mitre 20 SigmaHQ
T1490 Inhibit System Recovery mitre 27 SigmaHQ
T1491.001 Internal Defacement mitre 4 SigmaHQ
T1529 System Shutdown/Reboot mitre 8 SigmaHQ
T1561.001 Disk Content Wipe mitre 1 SigmaHQ
T1657 Financial Theft mitre nothing
T1027 Obfuscated Files or Information mitre report 94 SigmaHQ
T1027.002 Software Packing mitre 1 SigmaHQ
T1027.010 Command Obfuscation mitre 10 SigmaHQ
T1036 Masquerading mitre 40 thrunt
T1036.001 Invalid Code Signature mitre ~40 close only
T1036.004 Masquerade Task or Service mitre 3 SigmaHQ
T1036.005 Match Legitimate Resource Name or Location mitre 21 thrunt
T1070.003 Clear Command History mitre 9 SigmaHQ
T1070.004 File Deletion mitre 15 SigmaHQ
T1070.007 Clear Network Connection History and Configurations mitre ~20 close only
T1222.001 Windows Permissions mitre 5 SigmaHQ
T1564.001 Hidden Files and Directories mitre 9 SigmaHQ
T1564.012 File/Path Exclusions mitre ~10 close only
T1678 Delay Execution mitre nothing
T1679 Selective Exclusion mitre nothing
T1685 Disable or Modify Tools mitre 162 SigmaHQ
T1685.005 Clear Windows Event Logs mitre 8 SigmaHQ
T1686.003 Windows Host Firewall mitre 20 SigmaHQ
T1689 Downgrade Attack mitre 1 SigmaHQ
T1690 Prevent Command History Logging mitre 1 SigmaHQ

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1059-peoplesoft-psemhub-payload-execution, t1557-recaptcha-skinned-turnstile-gate, t1204-004-clickfix-run-dialog-execution, t1190-peoplesoft-psemhub-encoded-path-exploitation, t1505-003-peoplesoft-psemhub-webshell-drop, t1583-001-claims-registration-conjunction.

Sweep

No indicators. Either nobody has published any for The Gentlemen, or the reports cite values without marking them as IOCs. package.json