Loading story…
TheGentlemen ransomware group was linked to a string of newly reported intrusions affecting organizations in several countries and sectors, including Senvest Capital in financial services, Euroscreen in digital printing and projection technology, CRASL Accounting Services in the UK, Roadvision Systems in transportation software, Babcock Africa in engineering and critical infrastructure support, Gfeller Treuhand in Switzerland, and San Carlo Gruppo Alimentare in Italy. The incidents were disclosed through separate reports that described ransomware-related breaches or victim listings tied to the same actor, with most reports indicating compromises or discoveries clustered within a short period.
Available reporting indicates TheGentlemen operates as a dual-extortion ransomware group, combining file encryption with data theft to pressure victims, and has previously been associated with techniques including T1486 for data encryption for impact. Sector diversity among the reported victims suggests broad targeting rather than a single-industry campaign, spanning finance, accounting, logistics software, manufacturing-related technology, food production, and infrastructure-linked engineering. One report on Gfeller Treuhand said business operations were not disrupted despite the attack, while other notices characterized the events as ransomware-driven data breaches without releasing technical indicators or intrusion details.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
An August 19 report said The Gentlemen attacked Gfeller Treuhand, a fiduciary and real-estate company in Dübendorf, Switzerland. The report stated the company's operational functioning was not affected.
Babcock Africa, associated with babcock.co.za in South Africa, was reported as the victim of a ransomware-related data breach attributed to thegentlemen. The organization was described as an engineering and asset management company.
Roadvision Systems, which operates roadvision.com, was reported as the victim of a ransomware-linked data breach attributed to thegentlemen. The company was described as providing cloud-based trucking management software.
Senvest Capital was identified as the victim of a ransomware attack attributed to thegentlemen. The incident affected the financial services firm associated with senvest.com.
CRASL Accounting Services in Suffolk, UK, was reported as the victim of a ransomware-related data breach attributed to thegentlemen. The affected domain was crasl.co.uk.
Euroscreen, an Italian company operating euroscreen.it, was reported as the victim of a ransomware-linked data breach attributed to thegentlemen. The breach time was listed as 16:32 UTC.
A security notice identified San Carlo Gruppo Alimentare as a target of TheGentlemen ransomware. The visible content provides no further technical or impact details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcemalware.news
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceorkl.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026The Gentlemen ransomware group has emerged with highly adaptive and targeted campaigns, leveraging custom tools to bypass enterprise security and attack organizations in at least 17 countries. Their operations focus on manufacturing, construction, healthcare, and insurance, with a notable concentration in the Asia-Pacific region. The group employs advanced techniques such as legitimate driver abuse, Group Policy manipulation, and encrypted exfiltration, posing a significant threat to organizations regardless of existing defenses.
Jun 29, 2026
The Gentlemen ransomware group, also tracked as **Storm-2697**, has been linked to a string of new victims across multiple sectors and countries, including Dutch ice arena **Thialf**, U.S. IT services firm **Promatrix**, Indian companies **Delkart Industries**, **Kontact Consortium India**, and **Indus Protech Solutions**, and the UK-based **Angel Hotel**. In the Thialf incident, the attackers threatened to leak allegedly stolen internal documents, employee data, and financial contracts unless a ransom was paid, while the venue said its forensic investigation found minimal impact and no compromise of operational processes or core data. Reporting described Thialf as the group’s eighth known victim in the Netherlands and said the gang uses **double extortion** to pressure targets. Separate technical reporting said The Gentlemen is deploying a kernel-level driver, **`anticheatG13.sys`**, to disable endpoint protections before encryption. Analysts said the driver can terminate nearly **180 security-related processes** and supports process manipulation, file operations, kernel-memory modification, and network traffic control or redirection, extending functionality previously associated with **`G12drv.sys`**. The capability underscores a more aggressive tradecraft pattern in which ransomware operators use privileged drivers to suppress detection and forensic visibility before locking systems and threatening data exposure.
Aug 4, 2026