The Gentlemen RaaS Posts Seven New Victims June 8–9 Including Healthcare, Manufacturing, and Tech — Now Second Most Active Group of 2026 with 332 Published Victims

The Gentlemen ransomware-as-a-service operation — which appeared in August 2025 and has rapidly grown to 332 published victims in the first five months of 2026 — posted at least seven new victims to its dark web leak site on June 8–9, including Central Arkansas Pediatrics, IP Rings (automotive manufacturing, India), and Yao Yuan Technology (Taiwan). Check Point Research's deep analysis of a leaked internal database reveals the group is tightly operated by approximately nine core actors under administrator 'zeta88/hastalamuerte,' pays affiliates 90% of proceeds, and gains initial access primarily via internet-facing VPN and management interface exploits including Fortinet, Cisco, and ConnectWise ScreenConnect vulnerabilities. The Go-written, cross-platform locker targets Windows, Linux, and ESXi environments and deploys SystemBC for covert C2 tunneling.

The Go-written, cross-platform locker targets Windows, Linux, and ESXi environments and deploys SystemBC for covert C2 tunneling.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.