Thegentlemen

☆ pin

Also known as The Gentlemen, Phantom Mantis, ArmCorp, Zeta88, Hastalamuerte, Storm-2697

Reports

372

First seen

Apr 27, 2026

Last seen

Aug 14, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×84 Retail & E-commerce ×32 Healthcare ×30 Professional Services ×29 Technology ×24 Other ×22 Financial Services ×19 Education ×13

Victim regions

×7

×90

United States×90

France×19

India×14

Germany×13

Canada×9

Poland×8

Czechia×7

Italy×7

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×18T1190 Exploit Public-Facing Application ×14T1078 Valid Accounts ×9T1566 Phishing ×7T1562.001 Impair Defenses: Disable or Modify Tools ×6T1110 Brute Force ×6T1041 Exfiltration Over C2 Channel ×5T1021 Remote Services ×5T1003 OS Credential Dumping ×4T1133 External Remote Services ×4T1562 Impair Defenses ×4T1005 Data from Local System ×4

Indicators

domain ×1174ip_v4 ×513cve ×144hash_md5 ×105filename ×78hash_sha256 ×73hash_sha1 ×48hash_sha512 ×6url ×5bitcoin_address ×4email ×4registry_key ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Thegentlemen

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Thegentlemen ransomware gang publishes IPS as victim

Thegentlemen ransomware gang publishes Gfeller Treuhand und Verwaltungs AG as victim

Thegentlemen ransomware gang publishes Gravity Coffee as victim

Thegentlemen publishes Ollie's Place Kidswear as ransomware victim

Thegentlemen claims The Coffee Bean & Tea Leaf Malaysia breach

Thegentlemen ransomware gang claims KFC Kosova breach

Thegentlemen ransomware claims First Coast Heart & Vascular Center

Thegentlemen publishes Cityside Homes as ransomware victim

Thegentlemen ransomware gang publishes Retail Business Management Systems as victim

Thegentlemen ransomware gang publishes TOA Corporation as victim

Thegentlemen publishes Tempel Steel Company as ransomware victim

Thegentlemen ransomware gang publishes Plaza Auto Mall as victim

Thegentlemen Claims Avanta Maroc (Adecco Maroc) as Ransomware Victim

Thegentlemen ransomware group publishes EKEPIS (Greece) as victim

Thegentlemen ransomware gang claims Megalaser Industria Metalurgica LTDA

Thegentlemen claims Community Connections in ransomware extortion post

Thegentlemen ransomware gang publishes Acli as victim

Thegentlemen publishes Vector Two Technology as ransomware victim

State of Ransomware Q2 2026: Concentration Shifts as Top Groups Dominate 57.6% of Victims

Thegentlemen ransomware gang publishes Safeware Inc. as victim

Ransomware group hijacks hospital system's Facebook page amid ongoing cyberattack

Weekly Security Recap: AI Model Poisoning, Metabase 0-Day, Supply-Chain Worms, and Router Backdoors

Thegentlemen ransomware gang claims PharmaEssentia breach

Thegentlemen claims new victim: CONTAC Ingenieros

Thegentlemen ransomware gang claims RAK Construction victim

Thegentlemen publishes LanceSoft India as ransomware victim

Thegentlemen ransomware gang claims AIMS Group as new victim

Thegentlemen ransomware gang claims AnMed health system breach

Thegentlemen ransomware gang claims NTU Alumni Club breach

Thegentlemen publishes Canopy Support Services as ransomware victim