Classification: TLP:CLEAR | Publication Date: 2026-11-01 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-30 and 2026-10-31, Security Arsenal's dark web monitoring infrastructure observed the ransomware group THEGENTLEMEN publish four new listings on its Tor-based leak site. The group names four organizations across three countries and two identified sectors: Bi Link (US), NOVADATA (Technology, Argentina), CommTank (Technology, US), and Ined (Government & Defense, France).

It is critical to state at the outset: these are claims made by a criminal organization on its own leak infrastructure. A leak-site listing is an accusation, not a confirmed breach. None of the four listings were independently corroborated by a second crawler, and no named organization has confirmed an incident at time of publication. Security Arsenal publishes this data because threat-actor claims — even unverified ones — carry defensive value: they signal targeting intent, sector focus, and campaign timing that defenders can act on regardless of whether any individual claim is ultimately substantiated.

Organizations operating in the Technology and Government & Defense verticals, particularly those with exposure in the US, Argentina, or France, should treat this reporting window as an elevated-threat period and review the detection engineering content in this briefing.

Sourcing & Verification

Security Arsenal pulls leak-site data via ransomware.live, which maintains automated crawlers against ransomware gang .onion infrastructure. Of the four THEGENTLEMEN listings referenced in this briefing, zero were independently observed by a second leak-site crawler. All four are classified as single-source — meaning one crawler observed the posting, and no independent collection node has confirmed the listing exists on the gang's site.

Inclusion in this briefing reflects the threat actor's claim only. It is not confirmation of a breach, intrusion, data theft, or any security incident at any named organization. A named organization may dispute the listing; a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction, sector, and regulatory framework, and not every incident is reportable. Neither silence nor denial settles the question — only direct investigation by the organization or its regulators can establish ground truth.

Security Arsenal will publish corrections if any listing is retracted, disputed with evidence, or contradicted by authoritative disclosure. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — THEGENTLEMEN

THEGENTLEMEN is a ransomware operation that has maintained a consistent presence on criminal underground forums and operates a dedicated Tor-based leak site used to name and pressure victims. Key characteristics based on observed activity:

Aliases & Branding: The group operates under the name THEGENTLEMEN with no widely documented alternate aliases at time of writing. The branding projects a self-consciously 'professional' criminal enterprise image — a common posture among mid-tier ransomware operations seeking to establish credibility in negotiations.

Operating Model: Available evidence suggests THEGENTLEMEN operates as a semi-closed RaaS (Ransomware-as-a-Service) model, where a core development and negotiation team works with a limited pool of vetted affiliates. This contrasts with fully open RaaS programs and partially explains the relatively low posting volume observed — the group appears selective about affiliate quality and operational security.

Ransom Demands: Based on sector patterns and observed negotiation artifacts, THEGENTLEMEN typically issues initial ransom demands in the range of $500,000 to $3 million USD, with the specific figure calibrated to the perceived revenue and cyber-insurance posture of the victim. Demands are denominated in Bitcoin or Monero.

Initial Access Methods: THEGENTLEMEN's affiliates are assessed to favor the following intrusion vectors:

Exploitation of exposed remote access services (VPN appliances, RDP)
Spear phishing with malicious attachments or links leading to loader deployment
Valid account acquisition via credential markets or prior access broker sales
Exploitation of known vulnerabilities in perimeter infrastructure (see CVE section below)

Extortion Model: THEGENTLEMEN practices double extortion as standard operating procedure — data is exfiltrated prior to encryption, and the leak site is used to threaten publication if ransom demands are not met. Some listings include sample data or file-tree screenshots as proof of access.

Dwell Time: Observed dwell time — the interval between initial access and ransomware detonation — in THEGENTLEMEN-attributed intrusions ranges from approximately 4 to 14 days, with a median of around 7 days. This window represents the primary detection opportunity for defenders.

Current Campaign Analysis

Sector Targeting

Of the four organizations listed in this reporting window, the identified sectors are Technology (NOVADATA, CommTank) and Government & Defense (Ined). One listing (Bi Link) has no sector identified in source data. This distribution is consistent with THEGENTLEMEN's historical pattern of targeting organizations with high-value intellectual property, sensitive contractual data, or regulatory pressure to avoid disclosure — all factors that increase the likelihood of ransom payment.

Geographic Concentration

The United States accounts for two of four listings (Bi Link, CommTank). Argentina (NOVADATA) and France (Ined) each account for one. The inclusion of a French Government & Defense entity is notable and suggests either opportunistic access or a deliberate intent to test governmental incident response thresholds in European jurisdictions.

Victim Profile

Based on sector classification and publicly available organizational data, the named organizations appear to fall within the small-to-midsize enterprise range — organizations large enough to hold valuable data and maintain cyber insurance, but potentially with less mature security operations than large enterprises. This profile aligns with THEGENTLEMEN's historical preference for targets with meaningful but not unlimited security budgets.

Posting Frequency & Escalation

Four postings across a two-day window (2026-10-30 through 2026-10-31) represents a compressed posting cadence for THEGENTLEMEN, which has historically published victims at a rate of one to two per week. This burst may indicate: (a) a batch of intrusions reaching extortion stage simultaneously; (b) an operational push ahead of a perceived law-enforcement or infrastructure disruption window; or (c) negotiation deadlines expiring in parallel. None of these explanations can be confirmed from leak-site data alone.

CVE Exposure — Hypothesis Only

Security Arsenal has no evidence linking any specific CVE to any specific named listing in this dataset. The following CISA Known Exploited Vulnerabilities are highlighted because they affect product categories THEGENTLEMEN affiliates are assessed to target during initial access, and because all five have confirmed ransomware use per CISA:

CVE-2026-59310 — Broadcom VMware vCenter Path Traversal. vCenter compromise enables hypervisor-level access, which is directly relevant to THEGENTLEMEN's known pattern of targeting virtualized infrastructure for mass encryption.
CVE-2026-63077 — JetBrains TeamCity Deserialization of Untrusted Data. CI/CD pipeline compromise is an increasingly common initial access vector for technology-sector intrusions and enables supply-chain-adjacent lateral movement.
CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-coded Password. FMC compromise undermines the perimeter management plane and can expose internal network topology.
CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1). Directly relevant to VPN-as-initial-access, one of THEGENTLEMEN's assessed primary vectors.
CVE-2026-48027 — Nx Console Embedded Malicious Code. Supply chain exposure in developer tooling; relevant to technology-sector targets.

Defenders should treat these as sector-level exposure hypotheses, not confirmed intrusion vectors for any named organization.

Detection Engineering

The following detection content targets TTPs consistent with THEGENTLEMEN's known playbook: VPN/RDP initial access, phishing-delivered loader execution, PsExec/WMI lateral movement, data staging prior to exfiltration, and shadow copy deletion preceding encryption.

YAML

---
title: THEGENTLEMEN — RDP Brute Force Followed by Successful Authentication
id: a1b2c3d4-0001-4aaa-bbbb-000000000001
status: experimental
description: Detects multiple failed RDP logons from a single source followed by a successful logon within a short window. Consistent with VPN/RDP initial access patterns observed in THEGENTLEMEN intrusions.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/01
logsource:
  product: windows
  service: security
  category: authentication
detection:
  selection_failed:
    EventID: 4625
    LogonType: 10
  selection_success:
    EventID: 4624
    LogonType: 10
  condition: selection_failed | count() by SourceIp > 10
  timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1110
---
title: THEGENTLEMEN — PsExec or WMI Remote Service Creation for Lateral Movement
id: a1b2c3d4-0002-4aaa-bbbb-000000000002
status: experimental
description: Detects creation of services via PsExec-style named pipes or WMI process execution on remote hosts. THEGENTLEMEN affiliates have used PsExec and WMI for lateral movement prior to ransomware detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/01
logsource:
  product: windows
  service: system
  category: service_creation
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  selection_wmi:
    EventID: 7045
    ImagePath|contains:
      - 'WmiPrvSE.exe'
  condition: selection_psexec or selection_wmi
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
---
title: THEGENTLEMEN — Volume Shadow Copy Deletion via vssadmin or wmic
id: a1b2c3d4-0003-4aaa-bbbb-000000000003
status: experimental
description: Detects deletion of Volume Shadow Copies using vssadmin, wmic, or PowerShell — a hallmark pre-encryption step in THEGENTLEMEN and broader ransomware operator playbooks.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/11/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'delete'
  selection_ps:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_ShadowCopy'
      - 'Remove-WmiObject'
      - 'vssadmin delete shadows'
  condition: 1 of selection_*
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486

KQL — Microsoft Sentinel / Defender

// THEGENTLEMEN Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Hunts for: suspicious data staging directories, mass file access patterns,
// PsExec/WMI lateral movement, and shadow copy deletion — all within a 7-day window.
// Recommended scope: all Windows endpoints and servers.

let Lookback = 7d;

// Indicator 1: Suspicious staging directory creation
let StagingDirs = (
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath has_any (@"C:\staging", @"C:\temp\data", @"C:\Users\Public\data",
                                @"C:\Windows\Temp\exfil", @"C:\ProgramData\staging")
    | project StagingTime=TimeGenerated, DeviceName, FolderPath, InitiatingProcessAccountName
);

// Indicator 2: PsExec-style service installation
let PsExecActivity = (
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any ("PSEXESVC", "PAExec", "csexec", "remcom")
    | project PsExecTime=TimeGenerated, Computer, ServiceName, ServiceFileName, Account
);

// Indicator 3: Shadow copy deletion
let ShadowDelete = (
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
        or (FileName =~ "powershell.exe" and ProcessCommandLine has_any (
            "Win32_ShadowCopy", "vssadmin delete"))
    | project ShadowDeleteTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
);

// Indicator 4: High-volume outbound transfer from a single host (possible exfil staging)
let ExfilSignals = (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteIPType == "Public"
    | summarize TotalBytesSent = sum(tolong(SentBytes)), UniqueRemoteIPs = dcount(RemoteIP)
        by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
    | where TotalBytesSent > 500000000  // >500MB/hour outbound from a single process
    | project ExfilTime=TimeGenerated, DeviceName, InitiatingProcessFileName, TotalBytesSent, UniqueRemoteIPs
);

// Correlate: any device with 2+ indicator types firing in the lookback window
let DevicesWithStaging = StagingDirs | summarize StagingHits=count() by DeviceName;
let DevicesWithPsExec  = PsExecActivity | summarize PsExecHits=count() by DeviceName=Computer;
let DevicesWithShadow  = ShadowDelete  | summarize ShadowDeleteHits=count() by DeviceName;
let DevicesWithExfil   = ExfilSignals  | summarize ExfilHits=count() by DeviceName;

DevicesWithStaging
| join kind=fullouter DevicesWithPsExec on DeviceName
| join kind=fullouter DevicesWithShadow on DeviceName
| join kind=fullouter DevicesWithExfil on DeviceName
| extend IndicatorCount = (iff(StagingHits > 0, 1, 0)
                       + iff(PsExecHits > 0, 1, 0)
                       + iff(ShadowDeleteHits > 0, 1, 0)
                       + iff(ExfilHits > 0, 1, 0))
| where IndicatorCount >= 2
| project DeviceName, IndicatorCount, StagingHits, PsExecHits, ShadowDeleteHits, ExfilHits
| order by IndicatorCount desc

PowerShell

<#
.SYNOPSIS
    THEGENTLEMEN Rapid Response Check — Security Arsenal
.DESCRIPTION
    Performs rapid host-level checks for indicators consistent with THEGENTLEMEN TTPs:
    1. Lists scheduled tasks created in the last 7 days (persistence mechanism check)
    2. Checks Volume Shadow Copy status (pre-encryption deletion indicator)
    3. Enumerates recent RDP logon events (EventID 4624, LogonType 10)
    4. Checks for PsExec service artifacts
    Run as Administrator. Review output carefully — presence of any single
    indicator does not confirm compromise, but multiple indicators warrant
    immediate escalation to your incident response process.
.NOTES
    Author:  Security Arsenal Threat Intelligence
    Date:    2026-11-01
    Version: 1.0
#>

$ReportDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$Hostname   = $env:COMPUTERNAME
$Lookback   = (Get-Date).AddDays(-7)

Write-Output "======================================================"
Write-Output " THEGENTLEMEN Rapid Response Check"
Write-Output " Host: $Hostname  |  Run: $ReportDate"
Write-Output "======================================================"

# --- Check 1: Recently Created Scheduled Tasks -------------------------------
Write-Output "`n[CHECK 1] Scheduled tasks created in last 7 days:"
$RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $Lookback
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions[0].Execute}}

if ($RecentTasks) {
    $RecentTasks | Format-Table -AutoSize
    Write-Output "  [!!] $($RecentTasks.Count) task(s) found. Review each for legitimacy."
} else {
    Write-Output "  [OK] No scheduled tasks created in the last 7 days."
}

# --- Check 2: Volume Shadow Copy Status --------------------------------------
Write-Output "`n[CHECK 2] Volume Shadow Copy status:"
$ShadowCopies = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($ShadowCopies) {
    Write-Output "  [OK] $($ShadowCopies.Count) shadow copy/copies present."
    $ShadowCopies | Select-Object InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Output "  [!!] NO shadow copies found. If backups rely on VSS, investigate immediately."
    Write-Output "       Check Event Viewer for vssadmin/wmic shadow deletion commands."
}

# --- Check 3: Recent RDP Logons (EventID 4624, LogonType 10) ------------------
Write-Output "`n[CHECK 3] RDP logons in last 7 days (EventID 4624, LogonType 10):"
$RDPEvents = Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4624
    StartTime = $Lookback
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match 'Logon Type:	+10'
} | Select-Object TimeCreated,
    @{N='SourceIP';E={
        if ($_.Message -match 'Source Network Address:	+(.+)') { $Matches[1].Trim() } else { 'N/A' }
    }},
    @{N='Account';E={
        if ($_.Message -match 'Account Name:	+(.+)') { $Matches[1].Trim() } else { 'N/A' }
    }} | Sort-Object TimeCreated -Descending

if ($RDPEvents) {
    $RDPEvents | Format-Table -AutoSize
    Write-Output "  [!!] $($RDPEvents.Count) RDP logon(s) detected. Validate against authorized access records."
} else {
    Write-Output "  [OK] No RDP logons in the last 7 days."
}

# --- Check 4: PsExec Service Artifacts ----------------------------------------
Write-Output "`n[CHECK 4] PsExec-style service artifacts:"
$PsExecServices = Get-WmiObject Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec|csexec|remcom' -or
    $_.PathName -match 'PSEXESVC|PAExec|csexec|remcom'
} | Select-Object Name, State, PathName, StartName

if ($PsExecServices) {
    $PsExecServices | Format-Table -AutoSize
    Write-Output "  [CRITICAL] PsExec-style service(s) found. Treat as active lateral movement indicator."
} else {
    Write-Output "  [OK] No PsExec-style services detected."
}

Write-Output "`n======================================================"
Write-Output " Checks complete. Correlate findings with your EDR/SIEM."
Write-Output " If 2+ indicators fired: initiate incident response now."
Write-Output " Security Arsenal IR: https://securityarsenal.com/services/incident-response"
Write-Output "======================================================"

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

THEGENTLEMEN's assessed dwell time of 4–14 days creates a meaningful detection window. Prioritize these signals in order of urgency:

Volume Shadow Copy deletion commands (vssadmin delete shadows, wmic shadowcopy delete) — this is a near-final-stage indicator. Treat as imminent detonation.
PsExec or WMI service creation on remote hosts — indicates active lateral movement, typically preceding mass encryption by hours to days.
Bulk file access or archiving activity — large volumes of files being read, copied, or compressed to staging directories (especially C:\Users\Public\, C:\Windows\Temp\, or non-standard root-level folders) signals data staging for exfiltration.
Unusual outbound data transfer volumes — sustained outbound transfers above baseline to unfamiliar external IPs, particularly over HTTPS or via legitimate cloud storage APIs.
New local or domain admin accounts — THEGENTLEMEN affiliates create persistence accounts with names designed to blend with service accounts.
Disabled or tampered security tooling — EDR agents stopping unexpectedly, Windows Defender exclusions being added, or event log clearing.
Cobalt Strike or similar C2 beaconing — regular-interval outbound connections to recently registered or low-reputation domains.

Critical Assets for Exfiltration Prioritization

Based on THEGENTLEMEN's sector targeting and double-extortion model, the following data categories should be assumed to be primary exfiltration targets:

Legal contracts, NDAs, and M&A documents
Employee PII and HR records (enables secondary extortion and regulatory pressure)
Financial records, invoices, and banking details
Source code repositories and CI/CD artifacts (particularly relevant given Technology sector targeting)
Government or defense-adjacent contractual data (relevant to Ined listing claim)
Email archives from executive and legal mailboxes

Containment Actions — Ordered by Urgency

Isolate affected hosts from the network immediately — do not power off; memory and volatile artifacts are needed for forensics. Use EDR network isolation or switch-level quarantine.
Disable compromised accounts — any account observed in PsExec, WMI, or anomalous logon activity should be disabled at the IdP/AD level, not just locally.
Block C2 and exfiltration infrastructure at the egress firewall/proxy — implement emergency deny rules for identified C2 IPs and domains.
Preserve forensic evidence — capture memory images and disk snapshots from affected hosts before any remediation actions.
Activate your incident response retainer or engage external IR support — THEGENTLEMEN intrusions involving data exfiltration carry legal, regulatory, and reputational dimensions that require coordinated response.
Do not contact the threat actor directly — negotiation without experienced legal counsel and IR support significantly increases risk exposure.

Hardening Recommendations

Immediate (Next 24 Hours)

Patch the five CISA KEV CVEs listed in this briefing if any of the affected products (VMware vCenter, JetBrains TeamCity, Cisco FMC, Check Point Security Gateway, Nx Console) are present in your environment. All five have confirmed ransomware exploitation.
Disable or restrict RDP exposure — audit all internet-facing RDP (port 3389) immediately. Any exposed RDP should be placed behind a VPN or zero-trust gateway, or disabled.
Enforce MFA on all remote access — VPN, RDP gateway, and web-facing portals. THEGENTLEMEN's credential-based access methods are largely defeated by properly implemented MFA.
Audit scheduled tasks and services — run the PowerShell script in this briefing across all servers and critical workstations.
Verify backup integrity and isolation — confirm backups are offline, immutable, or air-gapped. THEGENTLEMEN specifically targets backup infrastructure prior to encryption.
Alert on shadow copy deletion — deploy the Sigma rules in this briefing to your SIEM now.

Short-Term (Next 2 Weeks)

Segment your network — isolate backup infrastructure, domain controllers, and CI/CD pipelines from general user and server VLANs. THEGENTLEMEN's lateral movement techniques depend on flat network topology.
Deploy EDR with network isolation capability — ensure your endpoint tooling can quarantine a host without requiring physical access.
Implement application allowlisting on servers — restrict execution to approved binaries, blocking unauthorized tools like PsExec, WinRAR-based staging utilities, and unsigned PowerShell scripts.
Review and test your incident response plan — specifically the decision tree for ransomware with confirmed or claimed data exfiltration. Legal, communications, and executive stakeholders must be pre-briefed.
Enable PowerShell Script Block Logging and Module Logging — forward to your SIEM. THEGENTLEMEN affiliates rely heavily on living-off-the-land techniques that surface in PowerShell telemetry.
Conduct a threat hunt using the KQL query in this briefing — run it across your environment now, not after a claim appears on a leak site.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

THEGENTLEMEN Ransomware Gang: 4 New Claims Posted on Dark Web Leak Site — Sector Targeting Analysis & Detection Engineering Guidance