Skip to main content
Ransomware Group

Thegentlemen

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Known victims1056

Threat level

CRITICAL

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • DumpBrowserSecrets
  • Hydra
  • KslDump
  • KslKatz
  • XenAllPasswordPro

DefenseEvasion

  • EDRStartupHinder
  • GFreeze
  • GLinker

DiscoveryEnum

  • ADFind
  • BloodHound
  • Censys
  • CertiHound
  • MANSPIDER
  • +4 more

Exfiltration

  • rclone

Networking

  • Chisel-ng
  • ProxyChains
  • Tor / Onion C2
  • openconnect

Offsec

  • Custom Go Locker (Windows/Linux/NAS)
  • NetExec (nxc)
  • PetitPotam
  • PrivHound
  • RegPwn
  • +6 more

RMM-Tools

  • AnyDesk

Indicators of Compromise (IOCs)

IP addresses

8
  • 193.143.1.142
  • 194.87.31.69
  • 178.130.46.120
  • 193.228.128.2
  • 192.42.116.104
  • 89.185.80.134
  • 92.39.211.142
  • 194.87.31.69

Get the complete IOC feed

The full IOC database by API, ready for your SIEM or SOAR.

Create free account

No credit card required · Free API key

Known infrastructure

The following Tor hidden services have been associated with this group:

  • i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion
  • Gentlecloud Protection

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on Thegentlemen’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida