The Gentlemen
A ransomware-as-a-service group first seen in mid-2025 that quickly became one of the more active operations of 2026. It gets in through edge devices and stolen credentials, disables security tools with vulnerable drivers, then uses Group Policy to encrypt across a domain.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
NCC Group says the operation has moved from an emerging group to frequent, high-paced operations, and ranked it second most active in April 2026.3 The Hacker News reports that affiliates keep 90% of proceeds,2 and Check Point says verified partners are offered EDR-killing tools.4 Acronis says some Qilin operators created it as a separate operation, which fits PRODAFT's account, but the two brands should not be merged.5
The most significant technical feature is scale. Check Point describes an option that copies the locker to NETLOGON and pushes it through a Group Policy scheduled task, so encryption begins almost simultaneously across a domain. Lockers exist for Windows, Linux, NAS, BSD and ESXi.4
There is a UK angle, though an indirect one. Check Point found more than 1,570 victims on a SystemBC server used by one affiliate, mainly in the US, followed by the UK and Germany. It does not know whether SystemBC is part of the wider operation, and it infers rather than confirms that victims are mainly organisations.4
By the time Group Policy is being used to deploy a locker, the attacker already holds domain admin. We would focus on edge device exposure and privileged access, and alert on driver loads and unexpected Group Policy changes.
How It Attacks
Based on Trend Micro's August 2025 investigation6 and Check Point's 2026 incident report.4 Check Point could not determine how access was gained in its case.
- 1
Get In
Likely through an internet-facing FortiGate server or a compromised administrator account in Trend Micro's case. Other reports cite Cisco and Fortinet edge devices and stolen credentials.
- 2
Gain Domain Admin
Appears on a domain controller with Domain Admin rights and tests credentials and reach.
- 3
Map the Network
Scans with tools such as Advanced IP Scanner and Nmap.
- 4
Disable Defences
Loads a vulnerable driver to kill security processes, turns off Defender, disables the firewall and clears logs.
- 5
Move and Persist
Uses PsExec, WMI, scheduled tasks and AnyDesk. One affiliate also used Cobalt Strike and SystemBC.
- 6
Steal the Data
Stages documents and sends them out with WinSCP in Trend Micro's case.
- 7
Encrypt Across the Domain
Pushes the locker through NETLOGON and Group Policy, or spreads it with built-in options.
Key Techniques
Selected from the group's ATT&CK v20 entry,1 plus Group Policy deployment from Check Point.4
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits vulnerable public-facing devices and services. |
| T1078 | Valid Accounts | Initial Access | Uses compromised credentials. |
| T1018 | Remote System Discovery | Discovery | Scans internal networks for hosts. |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation | Provides vulnerable driver tools to affiliates. |
| T1036.005 | Match Legitimate Resource Name or Location | Stealth | Names payloads to resemble known software. |
| T1219.002 | Remote Desktop Software | Command and Control | Uses AnyDesk to keep access. |
| T1484.001 | Group Policy Modification | Defence Impairment | Pushes the locker through Group Policy. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts victim data. |
| T1657 | Financial Theft | Impact | Uses double extortion to press for payment. |
Tools Observed
Defence Evasion
Discovery and Movement
Remote Access
Credential Theft
Data Theft
From ATT&CK,1 Trend Micro6 and Check Point.4 Some are legitimate tools. Cobalt Strike and SystemBC were seen with an affiliate in one case and may not apply to all.
Vulnerabilities
The Hacker News reports that Check Point says the group tracks and evaluates these CVEs.2 That is not the same as confirmed use in a given attack. Trend Micro named no CVE in its case.6
Warning Signs
Drawn from Trend Micro6 and Check Point.4 None of these proves an attack alone.
- New Group Policy scheduled tasks followed by a forced policy update
- Unexpected files appearing in NETLOGON
- Defender exclusions, disabled firewall or cleared event logs
- A vulnerable driver loading before security processes die
- AnyDesk on servers
- SMB1 being turned on
Defences That Matter
Reduce Edge Exposure
- Prioritise patching for edge devices, with the listed CVEs first.7
- Require MFA for firewall and VPN administration.
- Rotate edge device credentials after any exposure.
Protect Domain Admin
- Limit Domain Admin use and monitor Group Policy changes.
- Alert on credentials dumped from memory.
Defend the Defences
- Block known vulnerable drivers.
- Alert on Defender changes and event log clearing, and act before encryption starts.3
Plan for Domain-Wide Loss
- Test recovery from a domain-wide encryption event, including ESXi.4
Could You Spot a Group Policy Change Before It Encrypts Everything?
We can test your edge, identity and endpoint controls against the methods in this profile and help you close the gaps.
Sources
- MITRE ATT&CK: The Gentlemen (G1058), ATT&CK v20
- The Hacker News: report on The Gentlemen's leaked chats and PRODAFT's findings, 11 June 2026
- Security Boulevard: The Gentlemen is Making Its Mark in the Ransomware World, 28 May 2026
- Check Point Research: DFIR Report: The Gentlemen and SystemBC: A Sneak Peek Behind the Proxy, 20 April 2026
- Acronis TRU: Inside Qilin ransomware: ESXi attacks, affiliate networks and double extortion, 28 October 2026
- Trend Micro: Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed, 9 September 2025
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.