Report
The Gentlemen: A ZeroFox Intelligence Threat Actor Profile
Inside the Ransomware-as-a-Service Collective Behind 346 Attacks and Counting
This ZeroFox Intelligence profile gives security teams an overview of the group's operations, infrastructure, affiliate model, and tradecraft, along with the targeting patterns and operational security signals that point to a technically mature adversary worth tracking closely.
Download the Report
Built for Threat Intelligence and Security Teams
Ransomware coverage is everywhere. What security teams need is the analyst-grade detail that turns a name on a leak site into a defensible risk picture. This profile offers that level of specificity, drawn from the ZeroFox team's direct observation of The Gentlemen across dark web forums, Tor-hosted infrastructure, and confirmed attacks.
Inside the report, ZeroFox analysts cover:
- The full attack timeline, monthly incident counts, and regional distribution from September 2025 through April 2026
- The double extortion model, silent encryption mode, and the multi-channel extortion support service the group offers affiliates
- RaaS economics, including affiliate splits, onboarding terms, and access sourcing through credential markets
- Operational security posture, infrastructure footprint, and the same-day patch response to the Bedrock Safeguard decryptor
- Targeted industries and geographies, including the public sector pattern that signals an absence of ethical guardrails
Know your adversary before they show up on your network. Download the full ZeroFox Intelligence profile on The Gentlemen.
