THEGENTLEMEN Ransomware Gang: 4 New Leak-Site Claims — Sector Targeting Analysis & Detection Engineering

Classification: TLP:CLEAR | Publication Date: 2026-09-26 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

Executive Summary

THEGENTLEMEN has published four new victim claims on its dark web leak site within a 48-hour window (2026-09-24 through 2026-09-25), naming organizations in the Technology, Manufacturing, Retail & E-Commerce, and Other sectors across the United States, Singapore, and Portugal. All four listings currently carry a SINGLE-SOURCE corroboration tier — they appear on ransomware.live only, with no second-crawler confirmation that the postings even exist.

Organizations claimed by THEGENTLEMEN in this posting wave:

• FTAPI Software (Technology, US) — published 2026-09-25 [SINGLE-SOURCE]
• ENKEI***** (Manufacturing, country not disclosed) — published 2026-09-24 [SINGLE-SOURCE]
• Charles Keith (Retail & E-Commerce, SG) — published 2026-09-24 [SINGLE-SOURCE]
• Ligue se Grupo (Other, PT) — published 2026-09-24 [SINGLE-SOURCE]

These are claims made by a criminal actor, not confirmed breaches. Even so, the claimed sector and geographic mix is consistent with a deliberate cross-vertical extortion push, and the named organizations — and their sector peers — should treat this window as a trigger for proactive threat hunting against THEGENTLEMEN's known TTPs, which are detailed with detection content below.

Sourcing & Verification

• Corroboration status: 0 of 4 listings were independently observed by a second leak-site crawler. All 4 listings appear on a single source (ransomware.live) only.
• What inclusion means: Every organization named in this briefing is included because the threat actor claims to have compromised it. Inclusion is not confirmation of a breach. No corroboration tier in this dataset confirms a breach — only the organization itself or its regulator can do that.
• Disputes and denials: A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections to this briefing as new information emerges. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — THEGENTLEMEN

Aliases and branding. THEGENTLEMEN operates under a single primary brand with no widely confirmed aliases in current tracking. Like most modern extortion crews, it maintains a Tor-based leak site used to pressure victims through staged data-release countdowns.

Operating model. The group functions as a closed or semi-closed operation with RaaS characteristics — a core team controlling infrastructure and negotiation, with access likely sourced from a rotating set of initial access brokers (IABs) and a small affiliate pool rather than an open affiliate program. This hybrid model is consistent with its moderate victim cadence: high enough to sustain operations, low enough to retain operational discipline.

Ransom demands. Observed demands for groups in this tier typically range from the mid-six to low-seven figures USD, scaled to victim revenue and cyber-insurance posture, with a "double" price quoted for decryption plus non-publication of stolen data.

Initial access methods. THEGENTLEMEN's known tradecraft centers on:

• Edge-device and VPN exploitation — targeting perimeter appliances (firewalls, secure gateways, remote access concentrators) shortly after public exploit availability.
• Spear phishing with macro-enabled or script-based payloads — leading to loader deployment and follow-on Cobalt Strike or equivalent C2.
• Exposed RDP — brute force or purchased credentials, followed by immediate persistence.

Extortion approach. Classic double extortion: data is staged and exfiltrated before encryption, and the leak site is used as the primary pressure lever, with escalating teasers (file-tree screenshots, sample documents) ahead of full dumps.

Dwell time. Typical observed dwell time for crews in this profile is 5–14 days from initial access to detonation, with a compressed 48–72 hour burst of staging activity immediately before encryption. The pre-detonation window is where defenders win or lose — which is why the detection content below emphasizes staging and lateral movement over encryption itself.

Current Campaign Analysis

Sectors claimed. Technology, Manufacturing, Retail & E-Commerce, and Other. This spread indicates opportunistic breadth rather than a single-vertical focus — typical of a crew that buys access from brokers and monetizes whatever footholds are available.

Geography. United States, Singapore, and Portugal. The Singapore and Portugal claims extend the group's footprint beyond the traditional US-centric victim pool, suggesting either broker-sourced access in APAC/EMEA or deliberate diversification to dilute law-enforcement attention.

Victim profile. The claimed mix spans a mid-market software vendor, an industrial manufacturer, a regional retail brand, and a services group — a revenue range plausibly spanning tens of millions to several hundred million USD. This is the classic mid-market sweet spot: large enough to pay, often under-instrumented relative to enterprise peers.

Posting cadence and escalation. Four claims in ~48 hours represents an escalation burst relative to a 100-posting baseline of only 4 recent entries. Burst posting is frequently a negotiation-pressure tactic — a crew publishing multiple stalled negotiations simultaneously to force movement. Treat the next 7–14 days as elevated risk for data-release escalation against the named organizations.

CVE exposure context (hypothesis, not attribution). We have no evidence linking any specific CVE to any named organization above. However, THEGENTLEMEN's known edge-device exploitation tradecraft makes the following CISA KEV entries — all confirmed as exploited by ransomware actors — directly relevant sector-level exposure for the types of organizations claimed:

• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — perimeter VPN exposure; a direct match to this gang's known initial access pattern.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password) — management-plane compromise enabling network-wide visibility and lateral staging.
• CVE-2026-59310 (VMware vCenter path traversal) — virtualization-plane access; catastrophic for ransomware impact since hypervisor-level encryption maximizes blast radius.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD pipeline compromise, relevant to the Technology-sector claim pattern and software supply-chain staging.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-workstation supply-chain exposure.

Organizations in the claimed sectors should validate patch posture against all five immediately.

Detection Engineering

The following Sigma rules target THEGENTLEMEN's known playbook: VPN/edge exploitation artifacts, phishing-driven macro execution, PsExec/WMI lateral movement, and pre-encryption data staging plus shadow copy deletion.

---
title: THEGENTLEMEN - Office Macro Spawning Script or LOLBin Child Process
id: 9f3a1c2e-7b41-4e5a-a6d1-thegent001
status: experimental
description: Detects Office applications spawning script interpreters or LOLBins, consistent with THEGENTLEMEN phishing-macro initial access chains.
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cmd.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-in automation
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1566.001
  - thegentlemen
---
title: THEGENTLEMEN - PsExec or Remote Service Creation for Lateral Movement
id: 4b7e2d1a-9c52-4f6b-b8e2-thegent002
status: experimental
description: Detects PsExec-style remote execution and service installation patterns used by THEGENTLEMEN during lateral movement and pre-encryption staging.
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_service:
    CommandLine|contains:
      - 'ADMIN$'
      - 'IPC$'
      - 'sc.exe'
      - 'schtasks'
      - 'wmic'
      - 'powershell -enc'
      - 'powershell.exe -e '
  condition: selection_psexec or (selection_service and CommandLine|contains: '\\')
falsepositives:
  - Legitimate IT administration tooling; whitelist admin jump hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1053
  - thegentlemen
---
title: THEGENTLEMEN - Pre-Encryption Staging - Shadow Copy Deletion and Exfil Indicators
id: 7c1f8a3d-2e63-4a7c-c9f3-thegent003
status: experimental
description: Detects Volume Shadow Copy deletion, backup tampering, and archive/egress tool execution consistent with THEGENTLEMEN pre-detonation staging behavior.
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - CommandLine|contains:
        - 'vssadmin delete shadows'
        - 'vssadmin Delete Shadows'
        - 'wmic shadowcopy delete'
        - 'bcdedit'
        - 'wbadmin delete catalog'
        - 'wbadmin delete systemstatebackup'
        - 'diskshadow'
  selection_exfil:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\7z.exe'
      - '\rar.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  condition: selection_vss or selection_exfil
falsepositives:
  - Backup administrators; archive tools in software packaging teams
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1567
  - thegentlemen

The following KQL hunt query for Microsoft Sentinel identifies pre-ransomware staging: anomalous outbound volume from servers/workstations combined with archive-tool execution and shadow copy tampering within a correlated window.

// THEGENTLEMEN pre-detonation staging hunt: archive tools, VSS tampering, anomalous egress
let lookback = 14d;
let suspicious_procs = dynamic(["rclone.exe","megacmd.exe","7z.exe","rar.exe","winscp.exe","filezilla.exe","vssadmin.exe","wbadmin.exe","bcdedit.exe","diskshadow.exe"]);
let ProcEvents =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ (suspicious_procs)
       or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","delete catalog","delete systemstatebackup")
    | project DeviceName, AccountName, FileName, ProcessCommandLine, Timestamp, ProcEventId=ReportId;
let EgressAnomaly =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize BytesOut=sum(tolong(BytesSent)), ConnectionCount=count(), DistinctDest=dcount(RemoteIP)
        by DeviceName, bin(Timestamp, 1h)
    | where BytesOut > 2000000000 or (DistinctDest > 50 and ConnectionCount > 500);
ProcEvents
| join kind=inner EgressAnomaly on DeviceName, $left.Timestamp between ($right.Timestamp .. datetime_add("hour", 6, $right.Timestamp))
| project DeviceName, AccountName, FileName, ProcessCommandLine, BytesOut, DistinctDest, Timestamp
| order by Timestamp desc

Rapid-response triage script: enumerate exposed RDP, scheduled tasks created in the last 7 days, recent shadow copy state, and suspicious persistence run keys.

# THEGENTLEMEN Rapid Triage - run elevated on suspect hosts
Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Host "[!] RDP ENABLED. Listening check:"; Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Format-Table LocalAddress,OwningProcess }
else { Write-Host "[+] RDP disabled." }

Write-Host "=== [2] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-List

Write-Host "=== [3] Volume Shadow Copies ===" -ForegroundColor Cyan
$vss = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($vss) { $vss | Select-Object DeviceObject, InstallDate | Format-Table } else { Write-Host "[!] NO shadow copies present - possible tampering (T1490)." }

Write-Host "=== [4] Recent vssadmin / wbadmin / bcdedit Execution (Event 4688) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'vssadmin|wbadmin|bcdedit|diskshadow|rclone|megacmd' } |
  Select-Object TimeCreated, @{N='Cmd';E={($_.Message -split "`n") -match 'Process Command Line' }} | Format-List

Write-Host "=== [5] Suspicious Run-Key Persistence (Last 7 Days) ===" -ForegroundColor Cyan
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce' | ForEach-Object {
  if (Test-Path $_) { Get-ItemProperty $_ | Select-Object * | Format-List }
}

Write-Host "=== [6] Anomalous Outbound Volume by Process (Top 10, active) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } | Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 10 Count, Name, @{N='Process';E={(Get-Process -Id $_.Name -ErrorAction SilentlyContinue).ProcessName}} | Format-Table

Incident Response Priorities

T-minus detection checklist (before encryption fires):

• Shadow copy deletion or backup catalog tampering (T1490) — the single highest-fidelity pre-detonation signal.
• New or modified scheduled tasks and services on servers, especially with encoded PowerShell payloads.
• Archive tool execution (7-Zip, RAR) or rclone/MEGA-style exfil utilities on file servers and database hosts.
• Burst of SMB/ADMIN$ writes from a single workstation to many servers — mass-staging behavior.
• Cobalt Strike-style beaconing: periodic low-volume HTTPS to rare domains with consistent jitter.
• GPO or PsExec-based mass deployment attempts of unknown binaries.
• Credential dumping artifacts: lsass.exe access by non-system processes (T1003.001).

Assets this gang profile prioritizes for exfiltration:

• Finance and legal document stores (contracts, M&A material, payroll).
• Customer databases and e-commerce transaction records (directly relevant to the Retail & E-Commerce claim).
• Source code repositories and CI/CD artifacts (relevant to the Technology claim and TeamCity exposure).
• CAD/design and production documents in manufacturing environments.
• Email archives of executive and negotiation-relevant personnel.

Containment actions, ordered by urgency:

1. Isolate affected network segments at the switch/VLAN level — do not power off hosts (preserve memory).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing Domain Admin, service, and VPN accounts.
3. Block C2 and exfil egress at the perimeter; sinkhole identified infrastructure.
4. Snapshot and preserve forensic images of staging hosts before remediation.
5. Verify integrity of backup infrastructure and confirm offline/immutable copies are intact.
6. Engage IR retainer and legal counsel before any actor contact; preserve all leak-site evidence with timestamps.

Hardening Recommendations

Immediate (24 hours):

• Patch or mitigate all five KEV-listed exposures on internet-facing assets: CVE-2026-50751 (Check Point), CVE-2026-20316 (Cisco FMC), CVE-2026-59310 (vCenter), CVE-2026-63077 (TeamCity), CVE-2026-48027 (Nx Console).
• Enforce MFA on all VPN and remote access; disable IKEv1 Aggressive Mode on Check Point gateways where feasible.
• Block Office macro child processes via Attack Surface Reduction rules (the Sigma rule above doubles as your ASR audit query).
• Alert on any vssadmin/wbadmin/bcdedit execution outside of approved backup windows.
• Block or alert on rclone, MEGAcmd, and unsanctioned archive tools on servers.
• Run the triage PowerShell script on all internet-facing and high-value hosts.

Short-term (2 weeks):

• Segment backup infrastructure onto isolated, immutable storage with separate credentials; verify restore capability.
• Deploy LAPS and tiered administration; eliminate shared local admin passwords (blunts PsExec/WMI lateral movement).
• Implement egress filtering with TLS inspection for rare-domain beaconing and large-volume outbound detection (the KQL query above operationalized as an analytic rule).
• Restrict RDP to jump hosts only, behind VPN + MFA, with brute-force lockout policies.
• Establish leak-site monitoring and brand/domain monitoring so future criminal claims against your organization surface within hours, not weeks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub