The Gentlemen RaaS Surpasses 500 Victims in Under a Year — Now 2026's Second Most Active Ransomware Operator by Victim Count

The Gentlemen, a RaaS operation that spun off from Qilin in mid-2025 after a payment dispute, has become the second most prolific ransomware actor of 2026, claiming 117 victims in June alone — a near 4x increase from January. The group offers affiliates a 90/10 revenue split (among the highest in the underground market) and provides a full attack toolkit exploiting Fortinet edge devices, exposed VPNs, and stolen credentials for initial access. Targets span manufacturing, healthcare, energy, and government across 70+ countries, with the US remaining the primary focus; defenders should audit internet-facing network appliances and RDP endpoints for prior compromise indicators immediately.

The group offers affiliates a 90/10 revenue split (among the highest in the underground market) and provides a full attack toolkit exploiting Fortinet edge devices, exposed VPNs, and stolen credentials for initial access.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.