License to Encrypt: “The Gentlemen” Make Their Move

November 18, 2025 · Cybereason · Severity: CRITICAL

The ransomware group known as "The Gentlemen" has emerged as a significant cybersecurity threat, employing a dual-extortion strategy to target organizations globally. Since their appearance around July 2025, the group has encrypted sensitive files while exfiltrating critical business data, threatening to leak it on dark web sites unless ransoms are paid. Their tactics blend established ransomware techniques with newer, adaptive methods, allowing them to exploit evolving attack vectors effectively. The Gentlemen pose a persistent threat to businesses due to their ability to quickly adapt and their focus on high-value targets. Their combination of data encryption and public exposure pressure increases the likelihood of victims paying ransoms, amplifying financial and reputational risks. Organizations must prioritize robust cybersecurity measures, including data backups and threat detection, to mitigate the risks posed by this advanced and agile ransomware group.

Cybereason Threat Intelligence Team recently conducted an analysis of "The Gentlemen" ransomware group, which emerged around July 2025 as a ransomware threat actor group with relatively advanced methodologies. The Gentlemen group employs a dual-extortion strategy, not only encrypting sensitive files but also exfiltrating critical business data and threatening to publish it on dark web leak sites unless a ransom is paid. The group has demonstrated a unique approach by combining established ransomware techniques with newer strategies, making them quick to adapt to new attack vectors, allowing them to remain a persistent to evolving threat to organizations worldwide.