Thegentlemen

☆ pin

Also known as The Gentlemen, Zeta88, Hastalamuerte, Phantom Mantis, ArmCorp, Storm-2697

Reports

649

First seen

Apr 27, 2026

Last seen

Oct 17, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×146 Healthcare ×65 Professional Services ×63 Retail & E-commerce ×60 Technology ×41 Other ×32 Education ×32 Financial Services ×30

Victim regions

×14

×174

United States×174

France×25

India×22

Canada×20

Germany×18

Brazil×17

Italy×15

Australia×14

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×25T1190 Exploit Public-Facing Application ×19T1078 Valid Accounts ×14T1566 Phishing ×11T1041 Exfiltration Over C2 Channel ×8T1110 Brute Force ×8T1133 External Remote Services ×7T1021 Remote Services ×7T1562.001 Impair Defenses: Disable or Modify Tools ×6T1005 Data from Local System ×6T1059 Command and Scripting Interpreter ×5T1003 OS Credential Dumping ×5

Indicators

domain ×2221ip_v4 ×829hash_md5 ×169cve ×163hash_sha256 ×118filename ×87hash_sha1 ×82url ×10hash_sha512 ×7email ×6bitcoin_address ×5registry_key ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Thegentlemen

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Thegentlemen ransomware claims Wellington College International School Bangkok

Thegentlemen publishes Gio Dental & Med Spa as ransomware victim

Thegentlemen ransomware gang publishes Gio Dental & Med Spa as victim

Thegentlemen publishes First Dental Health as ransomware victim

Thegentlemen ransomware gang claims First Dental Health breach

Thegentlemen publishes AirQ as new ransomware victim

Thegentlemen claims AirQ as new ransomware victim

Thegentlemen ransomware group publishes Martin LLP as victim

Thegentlemen ransomware gang publishes Martin LLP as victim

Thegentlemen claims MAP SA, Swiss communications agency

Thegentlemen claims MAP SA (Swiss communications agency) as ransomware victim

Thegentlemen claims Suhai Segurança Pessoal breach on ransomware.live

Thegentlemen ransomware gang claims Suhai Segurança Pessoal breach

Thegentlemen ransomware gang claims SBI Audiovisual Medinbox breach

Thegentlemen claims SBI Audiovisual Medinbox victim on ransomware.live

Thegentlemen ransomware gang claims Saga University breach

Thegentlemen ransomware gang claims Saga University breach

Thegentlemen publishes Netcore Unbxd as ransomware victim

Thegentlemen claims Netcore Unbxd victim on ransomware.live

Thegentlemen ransomware gang publishes REGiO Nord as victim

Thegentlemen publishes REGiO Nord as ransomware victim

Thegentlemen ransomware gang publishes Museum Siam as victim

Thegentlemen claims Skin Center dermatology clinic victim

Thegentlemen ransomware gang publishes Thai Ha PCL (KASET) as victim

Thegentlemen ransomware gang publishes Inovar Packaging Group as victim

Thegentlemen ransomware gang publishes Inovar Packaging Group as victim

Thegentlemen ransomware claims Engineers Ireland as victim

Thegentlemen publishes North Bridge Venture Partners as ransomware victim

Thegentlemen claims victim: SONGWOOI, South Korean automotive parts supplier

Thegentlemen ransomware gang publishes Petroleum Telcom Communications as victim