A Closer Look at The Gentlemen’s Alleged Leak

Executive Summary

The Gentlemen is an active ransomware and extortion operation that emerged publicly in the second half of 2025 and rapidly scaled into a high-volume threat actor. Rather than a fully new group, it seems to be a continuation or reorganization of prior ransomware affiliate activity, with links to the Qilin ecosystem and the Russian-speaking actor “hastalamuerte”. Its growth likely reflects existing ransomware experience, affiliate relationships, and access to resources.