Threat Actor Profiles

The Gentlemen

1 briefing · first covered 5/20/2026 · last covered 5/20/2026

Indicators of Compromise

Subscribe to unlock this actor's full IOC list

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Attribution & Known Techniques

Matched to the gentlemen in MISP's open threat-intelligence galaxy (ransomware cluster).

No technique-level data in the matched source for this actor.

Coverage Timeline

5/20/2026 · ACTIVE CAMPAIGN

The Gentlemen Ransomware: 332 Victims in 5 Months and Your FortiGate Is the Target

The Gentlemen ransomware active campaign has hit 332 victims in 5 months via FortiGate CVE exploitation. Get full IOCs, TTPs, and defensive steps.

Not yet tracked for this actor

  • CrowdStrike Falcon / SentinelOne Deep Visibility-specific query syntax — hunting queries above (if any) are Microsoft Defender/Sentinel KQL
  • File transfer and exfiltration services used
  • Hunting queries — no FalconFriday rule matched this actor's known techniques
The Gentlemen: Threat Actor Profile | Decryption Digest | Decryption Digest