Table of Contents
Key Takeaway
- The Gentlemen ransomware crew scaled from a mid-2025 split with Qilin to more than 320 claimed victims by April 2026, and its victim map centers on Southeast Asia, South America, and Western Europe — not the United States.
- Check Point logged around 14,700 stockpiled FortiGate devices ready for affiliate reuse in March 2026, behind a 90/10 revenue split and a maintained EDR-killer toolkit led by GentleKiller.
- A leak-site listing is not a confirmed breach: The Gentlemen ransomware listed the Royal Thai Air Force on October 10, 2026, and no Thai confirmation has followed — while Southeast Asia absorbs 5 to 17 claims per week.
- The working defenses are unglamorous: inventory every edge device, audit how far your EDR assumption actually goes, lock down backup and Veeam exposure, and verify any leak claim before wiring money or speaking publicly.
- Filipino and OFW households sit inside the same map through remittance apps, regional hosting providers, and shared family devices — two-factor authentication and registrar transfer locks now do real risk work.
The Gentlemen ransomware gang listed the Royal Thai Air Force on its Tor leak site on October 10, 2026 — a 46,000-plus-personnel defense force whose portal publishes financial reports and procurement plans — and the listing carries no admission from Bangkok.
That claim is this week’s proof of a pattern agencies have documented all year: a ransomware-as-a-service operation that supplies its affiliates with stolen firewalls, ready-made EDR-killer tooling, and a victim map drawn across Southeast Asia. Check Point’s April 24, 2026 advisory (TA2026114) counts more than 320 claimed victims by then; NCC Group’s monthly data, reported in Computer Weekly’s May 27, 2026 report, ranks the gang second worldwide for April with 73 attacks — 10 percent of global volume, behind only Qilin’s 107.
This is not a US-centric gang. ESET’s June 18, 2026 research places its victimology across Southeast Asia, South America, and Western Europe, naming Thailand and Brazil among countries ransomware crews usually leave alone. For ASEAN readers — the IT admin at a regional SMB, the owner of a Thai guesthouse, a Filipino freelancer whose hosting sits on a Vietnamese provider — the practical question is what actually breaks this gang’s chain, and the answer is documented well enough to act on.
Who Are The Gentlemen Ransomware Operators?
Check Point’s timeline traces the split to July 2025, when an affiliate operator known as “hastalamuerte” walked out of the Qilin ransomware-as-a-service program after a public payment dispute and launched an independent brand. A Tor-based leak site went live in September 2025 with an advertised 90/10 revenue split — a richer deal than the industry’s customary 80/20, and one reason experienced operators moved across quickly. The gang runs lean — roughly 20 members per Check Point’s reading — but affiliates do not need to bring much: the crew supplies a Go-based locker covering Windows, Linux, NAS, and BSD, plus a separate C-based locker for ESXi hypervisors.
The Gentlemen ransomware operation grew from roughly 30 claimed victims across 17 countries in autumn 2025 to more than 320 by April 2026, with about 240 of those landing in the first months of 2026 alone. A compromised command-and-control server tied to one affiliate revealed a SystemBC botnet of more than 1,570 nodes in April 2026 — evidence, as Check Point put it, that the true footprint runs wider than the leak-site count. Fortinet’s FortiGuard Labs profile adds that affiliates have been observed pairing the ransomware with SystemBC proxy malware and Cobalt Strike beacons, with Mimikatz harvesting credentials in memory before lateral movement.
The Gentlemen Ransomware by the Numbers
Three independent counters bracket the gang’s 2026 scale. NCC Group’s April 2026 monthly data, reported May 27 by Computer Weekly, put The Gentlemen ransomware at 73 attacks in April — 10 percent of everything NCC observed, second only to Qilin’s 107, with DragonForce (63), Akira (52), and Coinbase Cartel (42) completing the top five, and more than 230 organizations hit by the gang so far that year. ThaiCERT published a country-level advisory on June 22, 2026 stating the group had claimed more than 504 victims by then. CTIWatch’s tracking, updated October 12, 2026, lists the group at 1,035 recorded victims across 90 countries.
The spread between those numbers matters less than the direction: The Gentlemen ransomware counters all move one way. The leak-site ledger undercounts — Check Point’s botnet telemetry already proved that in April — but each counter captures a different slice of the same accelerating machine. A gang ranked second globally in April, in its first full year of operation, has earned the profile treatment Southeast Asian newsrooms have not yet given it.
Why Southeast Asia Keeps Appearing on the Leak Sites
ESET’s June 2026 analysis made the geographic point plainly: The Gentlemen ransomware does not exhibit the US-focused victimology of most top-tier gangs, which routinely see roughly half their announced victims in the United States. Instead its affiliates concentrate on Southeast Asia, South America, and Western Europe — naming Thailand, alongside Brazil and France, among otherwise rarely targeted countries. ThaiCERT’s own June advisory echoed the same victimology for Thai organizations.
This week’s listings show the pattern live. CTIWatch recorded the Royal Thai Air Force listing on October 10, 2026 — Government & Defense sector, Thailand ranked 17th worldwide in the same database with 185 recorded victims. IntelFusions’ weekly tracker, published October 4, logged eight leak-site claims against Southeast Asian organizations for the week beginning September 28, inside a region-wide floor of 5 to 17 claims per week since July 2026.
Two of that week’s names — VUS, a Vietnamese English-centre chain, and Solaria, an Indonesian restaurant chain — landed on The Gentlemen’s own net; the same week put Qilin’s name on Bangkok’s Airport Rail Link operator, which we profiled when the Asia Era One listing appeared.
Context for the week’s other names, all claims by the gangs themselves: Rhysida listed Vietnam’s Mat Bao Corporation with a claimed 106.8 GB haul (746,108 files) that the listing says includes correspondence with VNNIC, NEAC, and the Government Cipher Committee; Qilin named Thai Lion Air on October 2; RansomHouse listed Indonesian coal producer PT Indo Tambangraya Megah; and in the Philippines, SafePay named Fe del Mundo Medical Center while Qilin listed diagnostics provider New World Diagnostics — both still unconfirmed by the organizations — the pattern our Philippines ransomware 2026 coverage has tracked all year.
The Weapon Stack: EDR Killers, Stealers, and Stockpiled Firewalls
What separates this gang from the pack is the tooling it hands to affiliates. ESET’s researchers describe GentleKiller, the in-house EDR-killer framework The Gentlemen ransomware supplies directly to its affiliate channel, with at least eight variants — each abusing a different vulnerable or malicious driver and impersonating a different legitimate product, game anti-cheat systems and security suites among the disguises.
ThaiCERT’s advisory documents the scale: the toolset targets more than 400 security processes from 48 major vendors, scanning every two seconds, and the group has adopted newly released vulnerable-driver proof-of-concept code within days of public release. Alongside the in-house framework sit credential harvester OxideHarvest and operationally integrated third-party killers HexKiller, ThrottleBlood, and HavocKiller.
Access, meanwhile, is pre-bought. Check Point’s March 2026 flag: roughly 14,700 compromised FortiGate devices held in a curated stockpile, alongside 969 validated brute-forced VPN credentials, letting affiliates skip reconnaissance entirely.
The exploited CVEs in Check Point’s table include a Fortinet FortiOS authentication bypass, CVE-2024-55591, and a privilege-escalation path via the TechPowerUp ThrottleStop driver — CVE-2025-7771 — that maps to the renamed ThrottleBlood BYOVD technique, plus Veeam Backup & Replication Cloud Connect missing authentication, CVE-2023-27532. Once inside, the locker’s Group Policy deployment mode copies itself onto the NETLOGON share and forces encryption across every domain-joined machine near-simultaneously — the technique NCC’s analysts singled out as shrinking defenders’ response window before encryption begins.
The May 2026 Leak of the Gang’s Own Playbook
In May 2026 The Gentlemen ransomware operation suffered an internal data leak of its own tooling, and ESET published the resulting insight on June 18, 2026. The leak had a specific payoff for defenders: it confirmed what ESET had hypothesized in February — that The Gentlemen ransomware operators actively develop and maintain a portfolio of EDR killers for affiliates, centered on GentleKiller — and it exposed the unified defense-evasion layer that standardizes impersonation across the gang’s tools using fake version information and copied legitimate certificates.
The irony is the durable angle: a gang that monetizes its victims’ stolen files could not keep its own internal data protected, and the discipline it sells is a discipline it failed.
What It Changes for Filipino Workers and OFW Families
The corridor reading is concrete. Filipino customers of Mat Bao-class providers — registrars and hosting companies serving businesses across the region, including Filipinos buying .vn domains through resellers — hold accounts whose exposure does not end at any ransom deadline when a provider’s registrar correspondence enters criminal hands — the exact leak mechanics our Vietnam data-breach economy reporting traced.
OFW families run remittance-critical accounts that cannot survive an outage the way pilgrims’ savings could not survive Tabung Haji’s eight-day channel shutdown in Malaysia this month. Hospital and diagnostic patients in the Philippines — the Fe del Mundo and New World Diagnostics listings both remain unconfirmed — face the same gap: learning about a putative breach of a pediatric hospital from criminals first. The Gentlemen ransomware is not the only crew on those sites, but it is the one whose map deliberately includes this region.
The individual action list is short and worth doing this week: turn on two-factor authentication for every registrar, hosting, remittance, and banking account; apply registrar transfer locks to any domain you own; keep a password manager vault for government-logins work; and treat any leak-site mention of your employer, bank, or hospital as unverified until the organization or a regulator speaks. WorldNgayon’s guide to building a 20-minute password manager vault for SSS, BIR, and DMW logins covers the setup.
The Defense Checklist for ASEAN Organizations and SMBs
The decisions worth making now against The Gentlemen ransomware stack, drawn from the four agency advisories:
- Inventory every edge device. FortiGate appliances are this gang’s proven entry path; Fortinet edge CVEs recur across Southeast Asian intrusions, and Singapore’s CSA advisories page carried active-exploitation alerts for Fortinet and related edge products as recently as October 3–9. Patch authentication-bypass and proxy CVEs first.
- Audit the EDR assumption. GentleKiller exists precisely to break EDR; check ESET’s published process lists and indicators of compromise against your fleet, monitor kernel-level driver loading, and alert on forced termination of security processes.
- Treat domain controllers as the kill chain. The Group Policy deployment path means one compromised domain controller can encrypt an entire fleet. Monitor NETLOGON writes and new GPO creation.
- Lock backup and Veeam exposure. CVE-2023-27532 is in the gang’s exploited table; offline, tested backups remain the only recovery that ends a ransom negotiation.
- Verify before you wire or speak. A listing is a claim; a 403-on-demand payment or a premature public admission both leak leverage.
Claim vs Confirmed: How to Read a Leak-Site Listing
Every name in this article from the October 4 and October 10 listings is a claim until its organization confirms — that is the reading discipline IntelFusions applies, and the one regional readers should adopt when The Gentlemen ransomware or any other crew posts a familiar name. Crews exaggerate, recycle stale data, and sometimes claim organizations that never existed.
Where a confirmed case exists — Malindo Air’s insider-driven breach, covered in our earlier reporting — it arrived through vendor-channel theft rather than headline-grabbing infrastructure exploits, as our Malindo Air breach investigation documented. The gap between listing and confirmation routinely runs weeks; the organization’s own statement, not the leak site, is the only trigger for the full response playbook.
The Gentlemen Ransomware FAQ
What is The Gentlemen ransomware?
A ransomware-as-a-service operation that split from Qilin around July 2025 and now ranks among the most active gangs worldwide, with affiliates working a 90/10 revenue split and inheriting the crew’s pre-built attack stack.
How many victims does The Gentlemen ransomware have?
Check Point counted more than 320 claimed victims by April 2026, ThaiCERT cited over 504 by June 22, 2026, and CTIWatch lists 1,035 as of October 12, 2026 — each counter differs by method, and the leak-site ledger undercounts.
Which vulnerabilities does The Gentlemen ransomware exploit?
Check Point’s table includes Fortinet FortiOS CVE-2024-55591 authentication bypass, the ThrottleStop privilege escalation CVE-2025-7771 used through the ThrottleBlood BYOVD technique, and Veeam Backup & Replication CVE-2023-27532.
Why does The Gentlemen ransomware target Southeast Asia?
ESET’s June 2026 victimology analysis places the gang’s focus on Southeast Asia, South America, and Western Europe, explicitly not the United States — a pattern that makes regional edge devices and regional hosting relationships its standing targets.
Was the Royal Thai Air Force actually breached by The Gentlemen ransomware?
Unknown. The listing appeared October 10, 2026, and no public confirmation from the organization exists as of October 12 — treat the name as a claim, not a confirmed breach.
What should a small business with a FortiGate firewall do first?
Confirm the device runs patched firmware beyond CVE-2024-55591’s fix cycle, restrict admin access, and check whether management access is exposed to the internet — the stockpile of 14,700 compromised devices means exposure plus stale firmware is the exact combination The Gentlemen ransomware’s affiliates buy.
Sources and How to Cite This Article
Facts in this piece trace to Check Point Threat Advisory TA2026114 (April 24, 2026), ESET’s June 18, 2026 research, NCC Group’s April 2026 monthly data via Computer Weekly (May 27, 2026), ThaiCERT (June 22, 2026), IntelFusions (October 4, 2026), and CTIWatch’s victim database (October 12, 2026). All leak-site listings are claims until the named organization confirms — and The Gentlemen ransomware deserves the same standard of proof as any other crew.
How to cite this page. Cite as: WorldNgayon, “The Gentlemen Ransomware: 14,700 Firewalls, the Ultimate 90/10 Deal,” WorldNgayon, October 12, 2026, worldngayon.com.
WorldNgayon delivers Digital Intelligence for the AI-powered world: inventory your edge devices this week, audit your backup restore path this month, and verify every leak claim before it changes a decision — the checklist above is the starting line.
