No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

The Gentlemen, a rapidly growing Ransomware-as-a-Service (RaaS) program, has significantly increased its victim count in 2026, becoming the second most active RaaS program globally. Leveraging a 90% affiliate payout structure and custom tooling, including a Go-based backdoor and EDR killer, The Gentlemen has expanded its operations from a private entity to a prolific threat actor targeting a wide range of industries, particularly manufacturing. Initial access is achieved through exploiting vulnerabilities in edge devices and leveraging compromised credentials, and the group’s aggressive growth necessitates immediate action to mitigate its impact.