Executive Summary

The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025 and rapidly scaled into a high-volume threat actor. Rather than a fully new group, it seems to be a continuation or reorganization of prior ransomware affiliate activity, with links to the Qilin ecosystem and the Russian-speaking actor “hastalamuerte". Its growth likely reflects existing ransomware experience, affiliate relationships, and access to resources.