The Gentlemen

Profile

The Gentlemen is a ransomware group that has been operating since July 2025 under a ransomware-as-a-service (RaaS) model, meaning it develops the encryptor and extortion infrastructure and leases them to affiliates who carry out the intrusions. Its standard approach is double extortion: encrypting the victim's systems while also stealing data to publish on its leak site if no ransom is paid. Its activity grew quickly during 2026, with leak-site listings rising from 48 in January to 105 in July. According to Cisco Talos, it was the most active ransomware group in Japan in the first half of 2026, with 14 confirmed incidents, and it has also been linked to attacks in Taiwan, the United States and the Philippines. The most affected sectors are manufacturing, technology and professional services.

Active since: 2025-07

What defenders should watch

• The high victim count in Japan and the wider Asia-Pacific region warrants prioritising defensive reviews at subsidiaries and plants there, particularly in manufacturing, technology and professional services.
• Because this is double extortion, backups alone do not prevent harm: strengthen detection of data exfiltration (anomalous outbound transfers, use of unauthorised cloud storage services).
• As a RaaS operation, different affiliates use varied entry techniques; keeping internet-facing services patched (VPN, remote access, web portals) and enforcing MFA reduces the attack surface most commonly abused in this model.
• Monitoring the group's leak site and sector advisories helps to spot early exposure of suppliers or partners that could affect your organisation.
• The sustained growth trend through 2026 suggests continued activity; rehearse the incident response plan and test restoration from isolated backups.

Recent victims

Sources analysed

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use (Cisco Talos, 9/17/2026)