The Gentlemen, a rapidly proliferating ransomware-as-a-service syndicate

The Gentlemen is an established criminal ransomware-as-a-service syndicate with a differentiated pricing model: taking a smaller margin from its affiliates. Unlike traditional arrangements, its affiliates keep 90% of proceeds, well above the usual 70% share. This is a key growth driver for a group that only surfaced in the mid-2025 – now ranking as the second most active ransomware operation globally. While the Gentlemen’s affiliates don’t specifically target Australia, they are opportunistic and sector-agnostic, which has gained them access into several Australian organisations in 2026.

The Gentlemen’s victims this year include education, retail, transport, health, financial services, manufacturing, construction and critical infrastructure. Initial access is not overly-sophisticated, it is typically opportunistic exploitation of unpatched edge devices – which was a trend mirrored in CI-ISAC’s Q2-26 Quarterly Threat Report.

What that looks like in reality is a short and specific list: internet-facing FortiGate and FortiOS devices that haven’t been patched, exposed RDP and remote management tooling, reused or default credentials with weak admin controls, and flat Windows networks with LDAP-integrated VPN accounts.

CI-ISAC’s National Intelligence Office produced a detailed threat advisory dissecting the  group’s actual attack chain and extensive use of Living off the Land (LoTL) techniques. The advisory breaks down each stage, highlighting the required Windows event IDs and actions to wrap detections around.

The full analysis, including specific recommendations, is available for download below.