TheGentlemen

TheGentlemen is a ransomware threat actor/group referenced as one of the leading ransomware groups observed in multiple 2025–2026 reporting datasets. It is described as targeting organizations in China, particularly in telecommunications, energy and utilities, information technology, and manufacturing. Reporting also associates it with exploitation of CVE-2017-17215 affecting NETGEAR routers. In April 2026 reporting, TheGentlemen was noted as increasing activity from 80 to 83 incidents and was characterized as showing increasingly industrialized ransomware operations. Specific tradecraft attributed to The Gentlemen ransomware includes use of SystemBC proxy malware for covert payload delivery, with reporting citing more than 1,570 infected corporate hosts, as well as use of Cobalt Strike, Mimikatz, and domain-wide propagation via Group Policy Objects. Separate detection content tied to Check Point DFIR reporting from April 2026 describes an inverted SMB staging pattern associated with TheGentlemen in which operators create a share on a source host, enable anonymous access, modify NullSessionShares and EveryoneIncludesAnonymous-related settings, and have target systems pull payloads over SMB using execution mechanisms such as WMI, Task Scheduler, SCM, or WinRM. The alias explicitly present in the content is "The Gentlemen," alongside the canonical form "TheGentlemen."