Actor Profile

The Gentlemen is a double-extortion ransomware gang that emerged around mid-2025. The group operates opportunistically across multiple sectors and geographies, targeting organizations based on access availability rather than strategic selection. The gang has demonstrated cross-platform capabilities, deploying ransomware on Windows, Linux, NAS, BSD, and ESXi systems. As of the incident disclosure, The Gentlemen's data leak site listed over 800 victims from 86 countries spanning manufacturing, technology, healthcare, transportation, and financial services sectors. The group follows a typical ransomware-as-a-service (RaaS) model with affiliate operations.

TTPs (Tactics, Techniques, Procedures)

Initial Access: Credential theft from third-party vendor environment (T1199 - Trusted Relationship, T1078 - Valid Accounts). The attackers obtained legitimate credentials for a Veradigm API reserved for customer services, enabling unauthorized access through a limited interface. Collection & Exfiltration: The threat actor copied patient data including personal details and Social Security numbers for approximately 3.5 million individuals (T1530 - Data from Cloud Storage, T1213 - Data from Information Repositories). Impact: Double-extortion tactics combining data theft with encryption capabilities (T1486 - Data Encrypted for Impact, T1657 - Financial Theft). Infrastructure: In April 2026, Check Point linked a Gentlemen affiliate to a SystemBC proxy malware botnet containing over 1,500 hosts, indicating use of proxy networks for C2 communications (T1090 - Proxy). Defense Evasion: In June 2026, ESET reported The Gentlemen deployed GentleKiller, a custom EDR killer tool designed to disable endpoint security products (T1562.001 - Impair Defenses: Disable or Modify Tools).

Targets & Patterns

The Gentlemen operates as an opportunistic threat actor with no apparent sector or geographic preference, targeting organizations based primarily on access availability. The gang has victimized entities across 86 countries and multiple critical sectors including healthcare, manufacturing, technology, transportation, and financial services. In this incident, the healthcare technology sector was targeted through Veradigm, a major provider of electronic health records and practice management software serving thousands of hospitals, clinics, and biopharmaceutical firms across the United States. The breach exposed approximately 3.5 million patient records containing highly sensitive personally identifiable information (PII) including full names, addresses, Social Security numbers, email addresses, and phone numbers. The targeting pattern suggests the gang exploits supply chain relationships and third-party vendor access as an initial access vector, capitalizing on weaker security postures in the vendor ecosystem to compromise higher-value targets. Healthcare remains an attractive target due to the sensitivity of medical data and operational pressure to restore services quickly.

Historical Context

The Gentlemen ransomware gang emerged around mid-2025 and has rapidly scaled operations, accumulating over 800 listed victims on its data leak site by September 2026. In April 2026, Check Point researchers discovered and attributed a SystemBC proxy malware botnet containing more than 1,500 compromised hosts to a Gentlemen affiliate, demonstrating the group's use of sophisticated proxy infrastructure for command-and-control operations. In June 2026, ESET researchers reported that The Gentlemen had begun deploying GentleKiller, a custom endpoint detection and response (EDR) killer tool designed to disable security products prior to ransomware deployment. This evolution indicates the group is actively developing its toolset to evade modern security controls. The Veradigm incident in September 2026 represents a continuation of the gang's opportunistic targeting strategy, exploiting third-party vendor relationships to gain access to high-value healthcare data. The group's consistent use of double-extortion tactics—combining data theft with encryption threats—aligns with broader ransomware ecosystem trends observed since 2020.

Defensive Recommendations

  • Implement strict third-party vendor security assessments and continuous monitoring, including credential hygiene audits and API access logging to detect unauthorized use of vendor credentials (addresses T1199, T1078)
  • Deploy behavioral analytics and anomaly detection on API endpoints to identify unusual data access patterns, particularly bulk data retrieval operations that may indicate exfiltration (addresses T1530, T1213)
  • Harden endpoint security by monitoring for EDR/security tool tampering attempts and implementing tamper-protection features; detect T1562.001 via Windows Event Logs (Security Event ID 4688, 4689) and Sysmon Event ID 1 for suspicious process terminations of security services
  • Monitor for SystemBC proxy malware indicators and unusual proxy/SOCKS traffic patterns that may indicate C2 communications; implement network segmentation to limit lateral movement from compromised vendor access points (addresses T1090)
  • Enforce least-privilege access controls and multi-factor authentication (MFA) for all API credentials, especially those provided to third-party vendors, with regular credential rotation and session monitoring to limit the impact of credential compromise