The Gentlemen after the leak: 654 listings since May

The Gentlemen, the ransomware-as-a-service operation whose internal Rocket.Chat database was put up for sale on 5 May 2026, has posted 654 organisations to its leak site in the 171 days since, more than any other ransomware operator in that period and twice its own pace in the 171 days before. I have examined a copy of the leaked chats, 3,733 messages between nine handles from 7 November 2025 to 30 April 2026, and set it against the Ransomtracker record of what the group did next. The leak exposed the crew in detail. It did not slow it down, nobody has been charged, and as of 23 October 2026 the leak site is still publishing.

About this analysis. The dataset I reviewed is the 44 MB proof set that circulated after the sale post: 22 Rocket.Chat rooms exported to CSV with 312 attached screenshots. I examined it offline for structure, dates and volumes only, and I have not reproduced any message, credential, network detail, personal data or screenshot here, and will not. The victim counts come from the Ransomtracker, which the Ransomnews Research Team pulled for me on 23 October 2026 and cleaned of 48 entries that were not organisations at all; I explain those below. Where I draw an inference rather than report a record, I say so and give my confidence. Leak-site listings are claims until a victim or a regulator confirms them, and I treat them that way throughout. Ransomnews edited this piece for style and checked the figures against the tracker.

In brief

• The Gentlemen listed 654 organisations between 5 May and 23 October 2026, against 311 in the 171 days before the leak. Its weekly rate rose from 19 to 27 listings.
• In that window it is the most prolific ransomware operator on the tracker, ahead of Qilin at 607, with 12 per cent of all 5,334 leak-site listings posted by every group.
• Across 2026 it stands second, 937 listings to Qilin’s 1,100, and it has more than doubled its total since Ransomnews reported 483 in June.
• Targeting moved toward North America: one in ten placed listings before the leak, three in ten after, against the Tier 1 to 3 plus Latin America plan written in the chats.
• Ransomnews has confirmed 93 attacks attributed to the group through victim statements and regulator filings, 53 of them since May, including Ecopetrol, AnMed, Nutex Health, Veradigm and Austria’s Chamber of Labour.
• The copy of the chats I reviewed is the same dataset Check Point, KELA and SOCRadar analysed. I rate it genuine at high confidence.
• On 22 and 29 August someone fed 48 injection-probe entries into the leak site’s submission system; automated trackers counted them as victims. Anyone quoting 1,063 for the group is 48 too high.
• No arrest, indictment, sanction or seizure has been announced. The administrator persona has been linked by Krebs on Security to a man in Izhevsk who did not respond to requests for comment.

Who are The Gentlemen?

The Gentlemen is a Russian-speaking ransomware-as-a-service operation that emerged in mid-2025 and recruits affiliates with a 90/10 revenue split in the affiliate’s favour. The Ransomtracker first captured its leak site on 9 September 2025, with 32 listings on day one. Barracuda’s August profile traces the core to a former Qilin affiliate crew, and Check Point Research assesses that the administrator handle zeta88, the forum persona hastalamuerte and the group’s public Tox identity belong to one person who builds the locker and the panel, selects targets, manages negotiations and takes the operator’s 10 per cent. The operator profile on the Ransomtracker carries every listing since launch, and the threat-group catalogue places the group against its rivals. I have followed the Russian-speaking forums where crews like this one advertise for two decades, and nothing about its structure is novel. What is novel is the speed.

What leaked, and is the copy genuine?

What leaked is a partial export of the group’s own chat server, and the copy is genuine. On 5 May 2026 a seller using the handle n7778 listed “The Gentlemen – Hacked Data for Sale” on the Cracked forum for $10,000 in Bitcoin and, a few days later, posted proof files on a file-sharing service. SOCRadar reported that the proof set ran to about 44.4 MB while the seller’s own screenshot showed 16.22 GB in total. Check Point Research published its reading on 13 May, SOCRadar on 15 May and KELA later that month; Ransomnews drew on KELA for its June report. The full 16 GB has never surfaced in public, and I have seen nothing to suggest it exists outside the seller’s hands.

The copy I obtained is the proof set, and four checks persuade me it is what it claims to be. The nine handles are exactly the nine Check Point named: zeta88, Protagor, Wick, qbit, mAst3r, quant, Kunder, JeLLy and Bl0ck. The date range, 7 November 2025 to 30 April 2026, matches KELA’s to the day. The message identifiers and timestamps carry the format of a Rocket.Chat export rather than something typed into a spreadsheet. And three organisations that later appeared on the leak site are discussed in the rooms 13, 17 and 33 days before their listings were posted, which is the sequence a genuine operations server produces and which a forger working backwards from public listings would struggle to fake across 3,733 messages. I rate the dataset genuine at high confidence, with the usual caveat that a proof set is a seller’s selection, not the whole server.

The shape of the server is the most useful thing in it. The administrator wrote 1,891 of the 3,733 messages, 51 per cent, and sits in 18 of the 22 rooms. Twelve rooms are two-person conversations, nine of them with him. Five are single-user channels used for notes and announcements, four of those his. Only five rooms have three or more participants. This is a hub with spokes, one builder talking to specialists who mostly do not talk to each other, and it matches what Check Point described as a tiered crew of trusted members and newcomers. Message volume follows the listing curve: 69 messages in November and December, then 1,176 in January, 754 in February, 1,096 in March and 638 in April, the months in which the leak site went from 17 listings a month to 104.

How much did The Gentlemen grow after the leak?

It doubled. The tracker holds 1,015 listings for the group since 9 September 2025, once the 48 non-victims are removed: 361 before the sale post on 5 May 2026 and 654 after. In the 171 days before the sale post the group listed 311 organisations; in the 171 days after it listed 653, an average of 27 a week against 19 a week between January and early May. July was the busiest month in the group’s history at 139 listings, followed by June at 125, August at 115 and September at 106. October stands at 91 with eight days to go, including 37 entries posted on 16 October alone and the run of 9 to 11 October that put Deloitte, KFC and MoneyGram on the site within 32 hours. The biggest genuine single day remains 6 April 2026, at 42.

Since the leak The Gentlemen is the most prolific operator on the tracker, 654 listings to Qilin’s 607, and 12 per cent of the 5,334 listings posted by every group combined in the same window. Across 2026 as a whole it remains second, 937 to Qilin’s 1,100, because Qilin had a 210-listing lead by May. When Ransomnews reported on the leak in June the group had 483 listings; it has more than doubled that in four months. The 2026 year archive ranks it against every other operator month by month.

Did the targeting change?

It shifted toward North America, and I rate that shift as likely rather than certain. The chats, as KELA summarised them, told operators to favour what the crew called Tier 1 to Tier 3 countries plus Latin America and to weigh operational pain over revenue. Ransomnews found only about 15 per cent of victims in the United States in June. Among the 627 post-leak listings that can be placed by country, 158 are American and 26 Canadian, 29 per cent together, with France, Germany, Italy and India next at 22 to 27 each. Among the 99 pre-leak listings that can be placed, North America was one in ten, Asia-Pacific a third and Latin America a fifth; after the leak Asia-Pacific fell to 18 per cent and Latin America to 11, while Europe held at 29. The caveat is the base: early listings carried no descriptions, so only 99 of 361 pre-leak entries can be placed, and the direction is clearer than the magnitude. The direction is away from the plan written in the chats and toward the market that pays most.

The listings are claims. The confirmed record is smaller and firmer. Ransomnews has verified 93 attacks attributed to The Gentlemen through victim statements, regulator filings and local reporting, 40 before May and 53 from May to September. The post-leak confirmations include Colombia’s state oil company Ecopetrol, which told Reuters in July that data tied to 3,300 accounts was stolen; the South Carolina health system AnMed; Nutex Health and Veradigm, which disclosed incidents to the US Securities and Exchange Commission in August and September; Austria’s Chamber of Labour, where ORF reported 270,000 records affected; a subsidiary of Spain’s Indra Group; South Africa’s MIP Holdings, whose compromise reached the insurers Hollard and LegalWise; Hong Kong Baptist University; Denmark’s National Museum; Croatia’s health ministry; and the German file-transfer provider FTAPI. Of the 53, ten involve healthcare providers or health-sector companies, seven are public bodies and three are universities. September’s count is provisional and appears in the monthly confirmed-attacks report.

What changed inside the operation?

The tooling changed; the business model did not. Check Point found that the administrator acknowledged the database leak in a dismissive post on 4 May and then turned to a communications overhaul, new storage and locker upgrades. The public research that followed tracked those upgrades in order: Microsoft dissected a self-propagating Go encryptor on 28 May; ESET documented GentleKiller on 19 June, a family of eight EDR-killer variants that hunts 400 processes belonging to 48 security products through vulnerable signed drivers; and in July Ransomnews reported the group’s use of a Kontron driver zero-day to reach the kernel. The 90/10 split administered by one builder is unchanged, and it is the reason the listings kept coming. A leak embarrasses the core. Affiliates are paid on results, and the results kept arriving.

The AI thread matured as well. In the spring the administrator described building the negotiation panel in three days with AI assistance, and the crew debated uncensored open-weight models for sorting stolen data. On 20 October SOCRadar reported that affiliates working for The Gentlemen and INC had left 8,257 messages from 133 coding-assistant sessions on an exposed server, showing commercial frontier models rented through an API broker being used to plan reconnaissance, generate commands, triage stolen data and draft extortion material, with refusals worked around by rewording requests as authorised red-team assessments. Recorded spending was just under $24,000. What the chats recorded as ambition in April was in production by the autumn.

Has anyone paid a price for the leak?

Not the operators. On 10 June Krebs on Security published a chain of forum registrations, email addresses and messaging accounts linking the administrator persona to a 36-year-old man in Izhevsk, Russia, who did not respond to requests for comment, and PRODAFT said its own findings matched the persona with high confidence. No arrest, indictment, sanction or infrastructure seizure has been announced in the five months since. The victims have paid, in the ordinary sense. The chief executive of MIP Holdings, the South African insurance software provider, told TechCentral in September that the company had paid a substantial ransom in return for a promise to destroy the data; the group published Hollard policyholder records anyway, and he put the exposure at the customers of roughly 45 insurers. The group that studied the Black Basta leak as a training manual, as KELA found, has now lived through its own and treated it as a nuisance. I would expect the operators to have read every analysis cited here, including this one.

Who is probing the leak site?

Someone with a scanner and a sense of humour. On 22 August 2026 the leak site published 47 new entries in one burst, and one more followed on 29 August. None was a company. The titles were test strings and lures such as “PAYOUT AUDIT – ACTION REQUIRED” and “REPORT QUEUE STALLED”, and the descriptions carried cross-site scripting, template-injection and path-traversal payloads with callbacks to an out-of-band testing service, apparently aimed at whoever opens submissions in the group’s administration panel. In other words, a researcher or a rival was testing the site’s own software for a way in, three months after the last way in worked. Automated trackers, ransomware.live and the Ransomtracker among them, ingested all 48 entries as victims, which is why some published counts for the group run 48 too high and why every figure in this piece excludes them. They remain visible on the live leak-site index for transparency. I rate the probing as a deliberate test of the panel at high confidence; who ran it, I do not know.

What this means for defenders

The leak was read in May as a window into a group that might not survive the exposure. The tracker says it was a window into a group about to have its best quarter, and three conclusions follow. First, the playbook in the chats is current, not historical: edge-device exploitation, bought and harvested credentials, mailbox abuse and EDR killing, with the FortiOS and NTLM-relay issues the crew tracked still the entry points to patch and monitor first. Second, stolen credentials and session cookies remain the cheapest route in. Any organisation can check its own exposure in circulating stealer logs on Stealercheck, and the access-broker market that feeds crews like this one has not contracted. Third, exposure without enforcement does not reduce victim counts. Until an arrest or a seizure follows a leak, the lesson other crews draw is the one The Gentlemen drew: keep posting. New entries continue to arrive on the daily digest, and Ransomnews will return to the group’s record at the end of the year.

Frequently asked questions

Sources and further reading

• Ransomnews Ransomtracker, The Gentlemen operator profile, listings recorded 9 September 2025 to 23 October 2026, and the Ransomnews confirmed-attacks database
• Check Point Research, Thus spoke The Gentlemen (13 May 2026)
• SOCRadar, Inside The Gentlemen ransomware leak (15 May 2026) and INC and The Gentlemen: exposed AI infrastructure (20 October 2026)
• KELA, Inside The Gentlemen leak (May 2026)
• Microsoft Threat Intelligence, Dissecting a self-propagating Go encryptor (28 May 2026)
• The Hacker News on ESET’s research, The Gentlemen RaaS uses GentleKiller (19 June 2026)
• Krebs on Security, Who runs the ransomware group The Gentlemen? (10 June 2026)
• Reuters, Colombia’s Ecopetrol says cyberattack stole data tied to 3,300 accounts (18 July 2026)
• TechCentral, Hollard client data dumped on the dark web (18 September 2026)
• Related: The Gentlemen ransomware: 483 victims and a leaked playbook (June 2026), The Gentlemen weaponised a Kontron driver to kill EDR (July 2026), and The Gentlemen list KFC, MoneyGram, Deloitte and Confluent (October 2026)

Dancho Danchev is a threat-intelligence researcher who has tracked the Russian-speaking cybercrime ecosystem since the early 2000s. His previous work for Ransomnews includes the RAMP administrator investigation and the Exploit.in forum history. The leaked chat export was examined offline for structure, dates and volumes only; no message content, credentials, personal data or screenshots have been reproduced.