The Gentlemen

Reported Context (11)

A group running a ransomware-as-a-service operation, according to the article. MITRE ATT&CK v20 Adds AI Abuse, MFA Bypass and Water Utility Attacks
Criminal online gang that claimed a breach of FTAPI on its darknet leak site; the article does not confirm the gang was responsible for the confirmed server intrusion. FTAPI Confirms Ransomware Incident on Internal Server
Ransomware group associated with 27 SAARC leak-site victim listings during April–September 2026; listings are not independently confirmed compromises. CYFIRMA Report Maps Cyber Threats Facing India and SAARC Telecom Sector
Ransomware group that listed Mandurah SES on its darknet leak site; the article reports data was published online. Mandurah SES Confirms Unauthorized Server Access; Operations Unaffected
A financially motivated ransomware-as-a-service operation that split from Qilin’s affiliate programme in July 2025. The Gentlemen Ransomware Group Scales Through Affiliates and Pre-Compromised FortiGate Access

CVE (21)

Malware (55)

People (6)

Threat Actors (92)

MITRE ATT&CK (30)

Vendors (40)

Products (70)

Tools (13)

Industries (42)

Countries (35)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.