Loading story…
Enterprise ransomware operations increasingly prioritize identity compromise, lateral movement, and data theft over immediately visible encryption. In Q4 2025, attackers used legitimate administration tools including RDP, SSH, PSExec, and native management utilities for lateral movement in 65% of observed cases; confirmed data exfiltration occurred in 94% of incidents, while encryption was confirmed in 68%. Defense evasion targeted endpoint protections, identity telemetry, and logging, and credential abuse increasingly relied on reuse, replay, inherited access, and trusted relationships. Cloud and SaaS environments have further reduced defender visibility and enabled faster, quieter exfiltration.
Stolen data is also becoming a durable criminal asset rather than a one-time leak: at least 10 extortion groups were reportedly analyzing, indexing, categorizing, and reselling exposed enterprise data by July 2026, using analysts, scripts, machine learning, or LLM-assisted workflows. The compromise of The Gentlemen's Rocket.Chat infrastructure exposed a structured affiliate operation targeting Fortinet VPNs, using CVE-2024-55591, stolen credentials, proxy-chained movement, custom G-BOT infrastructure, repurposed Velociraptor, and AI tools for negotiation and data triage. Follow-on artifacts showed rclone, Synology NAS, and MEGA-based exfiltration and potential Active Directory exposure, underscoring the need to revoke exposed credentials comprehensively, hunt for data-transfer tooling, harden repositories, and monitor stolen data for resale and downstream social-engineering or supply-chain abuse.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Lab-1 assessed that at least 10 ransomware or data-extortion groups were indexing or analyzing stolen data by July 2026, compared with one observed group in 2024. The groups used human analysis, AI/LLM-assisted workflows, or scripted extraction to increase extortion leverage and enable resale.
The n345 user released the alleged The Gentlemen archive freely on CryptBB. The archive exposed 3,366 messages from 22 Rocket.Chat rooms, screenshots, and operational files.
A user using the name n345 offered alleged The Gentlemen data for sale on PwnForums for $10,000 in Bitcoin.
The Gentlemen confirmed that part of its Rocket.Chat infrastructure had been compromised and that a leaked Rocket.Chat password was genuine. It claimed its control panel, blog, lockers, and other core components were unaffected.
Hosting provider 4VPS.SU disclosed that its website and client billing system had been breached through a proxy-server swap and phishing-redirection incident. The Gentlemen later attributed exposure of part of its Rocket.Chat infrastructure to this breach.
A Synology NAS at 193.228.128.2 received an rclone connection over SFTP on TCP port 2222, reportedly using the account d0wnloAd1. The infrastructure was later assessed as part of an rclone-to-NAS-to-MEGA exfiltration workflow.
The group migrated from Mattermost to a self-hosted Rocket.Chat instance on Tor in mid-November 2025. The subsequently leaked chat corpus covered activity from November 2025 through late April 2026.
The Gentlemen made its first public post to its data-leak site on September 9, 2025.
Coveware observed lateral movement in 65% of cases and confirmed data exfiltration in 94% of ransomware incidents during Q4 2025. Attackers commonly abused legitimate administration tools and reused or inherited credentials, while encryption was confirmed in 68% of incidents.
The Russian-speaking ransomware-as-a-service operation known as The Gentlemen emerged in July or August 2025.
A follow-on package, reportedly posted by an unverified user named n7778, allegedly contained material exfiltrated from infrastructure used by Zeta/The Gentlemen. Artifacts included a MEGA GDPR export, Synology NAS shadow data, evidence of rclone and MEGA staging activity, and alleged victim data including domain-controller backup metadata.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
ransom-isac.org
Open sourceransom-isac.org
Open sourceransom-isac.org
Open sourcecoveware.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
Jun 29, 2026
Reporting and research indicate **ransomware/data-extortion activity remained elevated through 2025 into early 2026**, with threat actors increasingly emphasizing **data theft, public pressure, and supply-chain leverage** rather than encryption alone. Cyble’s threat landscape findings cited by TechRepublic put 2025 at **6,604 recorded ransomware attacks** (up **52% YoY**), with **731 attacks in December** and **2,000+ claims in the last three months of 2025**; the same reporting also notes **supply-chain attacks nearly doubled**, increasing the potential blast radius when service providers are hit. A major example is *Conduent*, where the **January 2025 ransomware attack** is now assessed to have impacted **~25 million Americans** (up from an initial **10 million**), with reporting describing **~8TB of data** stolen including **Social Security numbers and medical data**, alongside days of operational disruption. Separately, Accenture-linked research reported that the **World Leaks** extortion operation added a custom Rust-based tool, **`RustyRocket`**, described as a stealthy **data-exfiltration and proxy** capability using obfuscated, multi-layer encrypted tunnels and a runtime “guardrail” requiring a pre-encrypted configuration—features intended to make detection and monitoring difficult. Broader ecosystem reporting also highlights how **data leak sites (DLSs)** and “naming-and-shaming” tactics have become central to double-extortion pressure, while a weekly incident roundup underscores continued real-world disruption from ransomware (e.g., impacts to public services) and ongoing regulatory consequences for inadequate security controls following breaches.
Jun 29, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026