THE Gentlemen has rapidly risen to ransomware prominence as a ransomware-as-a-service outfit that first surfaced in mid-2025, proving itself with a high pace of operations and notable sophistication. According to Check Point Research, the gang has claimed hundreds of victims and uses malware such as SystemBC to facilitate covert tunnelling and payload delivery, with victim telemetry tying to a botnet of more than 1,500 devices.
The group’s focus appears to be corporate and organisational environments rather than opportunistic consumers. Comparitech researchers said the gang claimed 202 attacks in the last quarter, while NCC Group reported 34 attacks in January and 67 in February, placing The Gentlemen among well-established actors like Cl0p and Akira.
Analysts note the operation combines a versatile locker set with built-in lateral movement and mass deployment capabilities, enabling enterprise-scale intrusions with ransomware detonation as the final stage.