The Gentlemen ransomware climbs to the top tier with a 90 per cent affiliate cut

A ransomware-as-a-service operation called The Gentlemen has gone from newcomer to one of the most prolific extortion brands of 2026 in about a year. Palo Alto Networks' Unit 42 published a profile of the group on July 10, building on an April report from Check Point Research that ranked it second by victims posted in 2026.

The group's rise shows how quickly the ransomware market reorganizes. Experienced operators follow the best deal, and a new brand with attractive terms can scale within months.

From affiliate to brand

According to Unit 42, The Gentlemen, also tracked as Storm-2697, has been active since at least July 2025. Public reporting suggests its operators were previously an affiliate of the Qilin ransomware program, known as ArmCorp, and that about 20 operators shifted from a private outfit to a ransomware-as-a-service model around September 2025.

In May 2026, the group announced a partnership with a version of the BreachForums cybercrime forum to recruit affiliates, penetration testers and initial access brokers, Unit 42 said.

The numbers

Leak-site counts vary by tracker. Check Point counted more than 320 victims since mid-2025 as of April 20, with 240 in 2026 alone. Unit 42 cited one source that counted 580 victims across 77 countries through July 7, including 103 manufacturers. Victims in the first half of 2026 were slightly more than six times the number in the last half of 2025, and June 2026 was the busiest month with 117 victims. Unit 42 placed the group behind only Qilin and Akira for 2026.

Those figures understate the real scale. Leak sites list only victims who did not pay. During an incident response, Check Point gained access to a live command server used by one Gentlemen affiliate and found a botnet of more than 1,570 likely corporate victims, more than the group had publicly claimed. Check Point said those systems appeared compromised and waiting for the next stage, with data likely already staged for theft.

Why affiliates are moving

The Gentlemen offer affiliates 90 per cent of each ransom, compared with the 70 to 80 per cent typical of rival programs. Check Point said that split is drawing experienced operators from other programs, and compared the group's growth to the early years of LockBit 3.

The trade-off for victims is speed. Check Point said the group typically gets in through exposed internet-facing devices such as VPNs, remote access gateways and firewall management portals, then encrypts whole networks within hours. In the case it investigated, the attacker already had domain administrator rights, moved to dozens of hosts, disabled security tools and pushed ransomware domain-wide through Group Policy.

Unit 42 listed a wider toolkit: a custom Go-based backdoor, an endpoint detection killer framework it calls GentleKiller, exploitation of a vulnerable ThrottleStop.sys driver (CVE-2025-7771) for privilege escalation, SystemBC for command and control, and encryptors written in C and Go for Windows, Linux and VMware ESXi. Check Point stressed that most techniques are well established rather than novel.

Who is being hit

Manufacturing and technology are the most frequently targeted sectors, with healthcare third, Check Point said, noting that some groups avoid hospitals. The United States has the most victims, followed by the United Kingdom and Germany. Neither report gave a figure for Canada.

What it means for defenders

The Gentlemen illustrate a pattern Canada's Cyber Centre described in its ransomware outlook: profit-driven groups adapting fast, while the entry points stay familiar. Because the group's intrusions move from access to encryption within hours, detection has to happen early.

What to do

• Patch VPNs, firewalls and remote access gateways promptly and remove management interfaces from the internet.
• Require multi-factor authentication for all remote access and administrative accounts.
• Alert on new Group Policy objects, disabled security agents and vulnerable driver loads.
• Keep offline backups of virtualization hosts, including ESXi configurations.