cyber.hendryadrian.com
Security News · cert-agid.gov.it

The Gentlemen Ransomware Group Reportedly Uses LLMs to Scale Operations

· Original article ↗

Summary

An article reports that The Gentlemen uses LLMs to analyze stolen data, develop tools, and tailor extortion, alongside infostealer credentials and unpatched Cisco and Fortinet devices. The group claims about 500 victims in under a year.

Key points

  • The Gentlemen reportedly claimed about 500 victims worldwide in less than a year; the article does not independently verify that number.
  • The group reportedly uses LLMs, including Qwen variants, to identify credentials, session cookies, and sensitive information in stolen data.
  • The article says an operator built the group’s negotiation platform in three days with AI-assisted coding and uses AI to tailor extortion emails and calls.
  • The group reportedly operates a Ransomware-as-a-Service model, offering affiliates 90% of ransom proceeds.
  • Reported access methods include purchasing infostealer-stolen credentials and scanning for unpatched Cisco and Fortinet devices.
  • A Go-based ransomware version reportedly supports a --spread parameter for self-replication and lateral movement; the article also describes Windows, Linux, and ESXi variants.
  • After internal chats leaked in May 2026, the group reportedly moved communications to decentralized platforms. Recommended defenses include patching exposed devices, revoking compromised credentials and sessions, and enabling MFA.

Article Details

Event Type
Reported ransomware operation using LLMs and automation
Impact
The Gentlemen reportedly claimed around 500 victims worldwide in less than a year. The article says the group uses LLMs to analyze stolen data and tailor extortion communications, and that its Go-based ransomware variant can self-replicate to automate encryption across corporate networks. It also reports that the group moved its communications to decentralized platforms after a May 2026 data leak.

MITRE ATT&CK

T1078 · Valid AccountsThe article reports that the group obtains initial access using legitimate credentials stolen through infostealer malware.T1595 · Active ScanningThe article reports that the group scans for exposed Cisco and Fortinet devices with known unpatched vulnerabilities.

Threat Actors

Black BastaThe article identifies Black Basta as a competing criminal group whose stolen confidential data and internal manuals The Gentlemen reportedly used to refine its tactics and workflows.The GentlemenReported ransomware group that uses LLMs and automation in its operations and reportedly claimed around 500 victims worldwide in less than a year.

Vendors

CiscoThe article also describes its RaaS model, exploitation of infostealer-obtained credentials and unpatched Cisco and Fortinet devices, and its rapid response after a May 2026 data leak by moving communications toFortinetalso describes its RaaS model, exploitation of infostealer-obtained credentials and unpatched Cisco and Fortinet devices, and its rapid response after a May 2026 data leak by moving communications to decentralized

Products

ESXi[T1105 ] Ingress Tool Transfer – The attackers deploy ransomware variants and supporting tools across multiple environments [‘ransomware distributed in five variants (Windows, Linux, ESXi)’]Linux[T1105 ] Ingress Tool Transfer – The attackers deploy ransomware variants and supporting tools across multiple environments [‘ransomware distributed in five variants (Windows, Linux, ESXi)’]Microsoft Windows[T1105 ] Ingress Tool Transfer – The attackers deploy ransomware variants and supporting tools across multiple environments [‘ransomware distributed in five variants (Windows, Linux, ESXi)’]Qwen#TheGentlemen

Related Articles