ctipilot.ch

The Gentlemen

actor · actor:thegentlemen single-source

Ransomware-as-a-service operation (also tracked as Storm-2697 / Phantom Mantis) that surged in Q1 2026 — 192 attacks, +588% QoQ, 32% of victims European, with FortiGate CVE-2024-55591 as the initial-access funnel. ESET (2026-06-18) documents the operators centrally building and maintaining the GentleKiller EDR-killer framework (BYOVD, 48 vendors) for their affiliates.

Aliases: Gentlemen RaaS, Storm-2697, Phantom Mantis

Coverage timeline
27
first 2026-05-04 → last 2026-08-16
Peak priority
high
7 high · 20 notable
Sources cited
66
53 hosts
Sections touched
7
active-threats, research, weekly-annual-reports
Co-occurring entities
1
see Related entities below
ATT&CK techniques
17
pinned v19.2 · see below
2026-05-0427 appearances2026-08-16

Hunting pivots

ATT&CK techniques
T1486 ×5T1190 ×3T1078T1133T1199T1490T1567T1567.002T1587.001T1685
Affected products
Fortinet FortiOSFortinet FortiProxy
Tags
ransomware ×24organized-crime ×19data-breach ×6russia-nexus ×4actively-exploited ×3identity ×3ot-ics ×3supply-chain ×2vulnerabilities ×2ai-abuselaw-enforcementlpenation-state

ATT&CK techniques

17 techniques observed across 8 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1587.001Develop Capabilities: Malware×1

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Evidence: 2026-07-19/weekly-w29-thegentlemen-storm2697-status · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

T1190Exploit Public-Facing Application×3

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-19/weekly-w29-thegentlemen-storm2697-status · 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · 2026-07-12/weekly-w28-the-gentlemen-status · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · ATT&CK page ↗

Execution TA0002

T1047Windows Management Instrumentation×1

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1053Scheduled Task/Job×1

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

Persistence TA0003

T1053Scheduled Task/Job×1

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-06-19/eset-the-gentlemen-raas-gang-centrally-builds-and-maintains · ATT&CK page ↗

Privilege Escalation TA0004

T1053Scheduled Task/Job×1

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-06-19/eset-the-gentlemen-raas-gang-centrally-builds-and-maintains · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×2

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-12/weekly-w28-the-gentlemen-status · 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

Lateral Movement TA0008

T1021Remote Services×2

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-04/akira-playbook-quarterly-context-q1-2026-healthcare-concentr · ATT&CK page ↗

T1021.002Remote Services: SMB/Windows Admin Shares×1

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-06-12/the-gentlemen-ransomware-478-claimed-leak-site-victims-self · ATT&CK page ↗

Exfiltration TA0010

T1567Exfiltration Over Web Service×1

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-07-18/metro-mondego-thegentlemen-ransomware-portugal-transit · ATT&CK page ↗

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage×1

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×5

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · 2026-07-19/weekly-w29-thegentlemen-storm2697-status · 2026-07-19/weekly-w29-ch-eu-public-sector-ci-incidents · 2026-07-18/metro-mondego-thegentlemen-ransomware-portugal-transit · 2026-07-12/weekly-w28-the-gentlemen-status · ATT&CK page ↗

T1490Inhibit System Recovery×1

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-08-16/weekly-w33-q2-ransomware-reports-dragos-checkpoint · ATT&CK page ↗

Story timeline

  1. 2026-08-16Two independent Q2 2026 ransomware reports published three days apart agree the ecosystem is fragmenting without de-concentrating — and the industrial one carries a negative finding OT operators should plan against: no Q2 case reached control-system manipulation
    weekly-annual-reportsDragos and Check Point both counted Q2: 93 active groups against a 57.6% top-ten share, and zero incidents reaching ICS Stage 2
  2. 2026-07-19The Gentlemen (Storm-2697) status: ReliaQuest's Q2 2026 numbers put it ahead of Qilin on the ransomware leaderboard, and a European public-transport victim (Metro Mondego) landed this week
    weekly-long-runningThe Gentlemen status — ReliaQuest ranks it Q2's most-active operator (300 vs Qilin's 289) on an AI-accelerated affiliate kit; it hit Metro Mondego (Portugal)
  3. 2026-07-19Swiss and European public-sector, utility and transport organisations carried the week's home-region incident load — a land registry offline for days, two Swiss utilities/foundations hit through third parties, an EU transit ransomware and a EUR 1.7M telco enforcement
    weekly-sector-patternsW29 home-region incidents — ANCPI Romania offline for days, IWB Basel and Geneva's IFAGE breached, Metro Mondego ransomware, Wind Tre fined EUR 1.7M
  4. 2026-07-18TheGentlemen ransomware hits Portugal's Metro Mondego (Coimbra light-rail); operator confirms attack, notifies CNCS and CNPD
    active-threatsMetro Mondego confirms a 6 July ransomware attack on internal systems — transport operation unaffected; TheGentlemen claims data theft
  5. 2026-07-12The Gentlemen (Storm-2697) status update — Unit 42's full profile: 580 victims, a Qilin-affiliate lineage, and a suspected EDR-disable zero-day
    weekly-long-runningThe Gentlemen status update — Unit 42 profiles 580 victims/77 countries, ArmCorp/Qilin lineage, 90% affiliate cut, suspected EDR-disable zero-day
  6. 2026-07-12Looking ahead — 2026-W28
    weekly-looking-aheadLooking ahead — 2026-W28: items already in motion for the coming weeks
  7. 2026-06-29The Gentlemen
    weekly-long-running
  8. 2026-06-29ESET "Killing me gently" — a de-facto mid-year RaaS-tooling report
    weekly-annual-reports
  9. 2026-06-27"The Gentlemen" ransomware claims 478 victims and adds worm propagation — Switzerland the second-most-targeted European country
    active-threats
  10. 2026-06-22The Gentlemen — EDR-killer framework documented, OT-adjacent victim claimed, operator named
    weekly-multi-day
  11. 2026-06-22Energy, water & OT — perimeter and process failures, with an OT-adjacent halt
    weekly-sector-patterns
  12. 2026-06-22Check Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany named
    weekly-annual-reports
  13. 2026-06-20The Gentlemen (Storm-2697) claims OT-adjacent Mackay Sugar attack; operator attributed to a Russian national
    active-threats
  14. 2026-06-19ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework
    research
  15. 2026-06-12The Gentlemen ransomware: 478 claimed leak-site victims, self-propagating Go encryptor, operator publicly named
    active-threats
  16. 2026-05-29The Gentlemen ransomware — Microsoft publishes full technical dissection of the Storm-2697 Go-encryptor
    active-threats
  17. 2026-05-25The Gentlemen / Storm-2697 — internal "Rocket" backend leaked by a rival; KELA and Check Point dissect the operator inner circle
    weekly-long-running
  18. 2026-05-25Check Point Q1 2026 State of Ransomware — ecosystem reconsolidates; LockBit returns with a deliberate Europe pivot
    weekly-annual-reports
  19. 2026-05-23Rapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 days
    research
  20. 2026-05-18The Gentlemen RaaS — Czech university and Swiss engineering firm listed; comms overhaul continues
    weekly-long-running
  21. 2026-05-14The Gentlemen RaaS — backend "Rocket" database leaked (16.22 GB), Check Point analysis exposes operator handles, ZeroPulse C2 internals, 1,570+ victims, decryptor published on GitHub
    active-threatsThe Gentlemen RaaS — backend "Rocket" database leaked (16.22 GB), Check Point analysis exposes operator handles, ZeroPulse C2 internals, 1,570+ victims
  22. 2026-05-11"The Gentlemen" RaaS — operations continue post-leak, decryptor published, FortiOS / Erlang SSH initial access CVEs confirmed
    weekly-long-running
  23. 2026-05-11Looking ahead — 2026-W20
    weekly-looking-ahead
  24. 2026-05-11Check Point April 2026 ransomware analysis — Qilin leads at 15%, Germany at 5% of global victims
    weekly-annual-reports
  25. 2026-05-04The Gentlemen RaaS — Europe-skewed operation surged approximately 448% QoQ; 32% of Q1 2026 victims in Europe; FortiGate CVE-2024-55591 initial-access funnel
    weekly-long-running
  26. 2026-05-04Looking ahead — 2026-W19
    weekly-looking-ahead
  27. 2026-05-04Akira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victims
    weekly-long-running

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

overlaps with

documented in

attributed activity

Where this entity is cited

  • weekly-long-running8
  • active-threats6
  • weekly-annual-reports5
  • weekly-looking-ahead3
  • research2
  • weekly-sector-patterns2
  • weekly-multi-day1

Source distribution

  • attack.mitre.org5 (8%)
  • research.checkpoint.com4 (6%)
  • blog.checkpoint.com3 (5%)
  • helpnetsecurity.com3 (5%)
  • bleepingcomputer.com2 (3%)
  • huntress.com2 (3%)
  • almalinux.org1 (2%)
  • bankinfosecurity.com1 (2%)
  • other45 (68%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (66)

Entries about The Gentlemen (27)

2026-08-16 · view entry permalink →

NOTABLENATOB1

Two independent Q2 2026 ransomware reports published three days apart agree the ecosystem is fragmenting without de-concentrating — and the industrial one carries a negative finding OT operators should plan against: no Q2 case reached control-system manipulation

Two quarterly ransomware reports landed three days apart this week, counting different populations from different vantage points, and arriving at compatible descriptions of the same structural shift. Taken together they are the closest thing to an outside check on what the operational entries of the last quarter have shown one incident at a time.

Dragos's Industrial Ransomware Analysis for Q2 2026 counts incidents affecting industrial organisations: "Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1," with manufacturing the most affected sector at 747 incidents or 65%, and engineering firms, system integrators and equipment manufacturers second at 117 — a distribution that puts the industrial supply chain, not the plant, at the centre. The regional detail is where it becomes a European planning input rather than a US one: the United States remains the most impacted country by a wide margin at 431 incidents or 38% of the total, but "the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany" (Dragos, 2026-08-10) — an eighty-four per cent rise in a neighbouring jurisdiction whose industrial base overlaps heavily with the Swiss one.

Check Point Research's State of Ransomware Q2 2026 counts leak-site victims across all sectors and describes the ecosystem's shape: "The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report," against a total of 2,139 victims that was essentially flat quarter over quarter and up 33% year over year. Qilin remained the most prolific operator for a fourth straight quarter with 279 victims despite its own count falling 17%, while The Gentlemen surged 62% to 269 and briefly outpaced it; the US share of victims fell from 50% to 42%, which Check Point attributes to the fastest-growing groups — The Gentlemen and the newly active Krybit — targeting the US less often than the ecosystem average (Check Point Research, 2026-08-13). That last point is the one European defenders should read twice: a falling US share in a flat total is not a reduction in activity, it is a redistribution toward everyone else. Check Point also records, independently of this pipeline's own observations this week, that "The exploitation window kept narrowing, with AI increasingly cited as the accelerant."

The single most consequential finding in either report is a negative one, and it belongs to Dragos: "Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends."

Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, an 12% increase over the 1,020 recorded in Q1.

Dragos observed no case in Q2 2026 in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; where operational disruption occurred, it followed encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends.

However, the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany.

Dragos 2026-08-10

The top 10 groups accounted for 57.6% of all victims, down from 71% in Q1, while the number of active groups climbed from 71 to 93, a new high for the period tracked in this report.

The exploitation window kept narrowing, with AI increasingly cited as the accelerant.

Check Point Research 2026-08-13
annual-report16 Aug 23:59Zmulti-sourceOpen finding ↗
Sources: Dragos · Check Point Research

2026-07-19 · view entry permalink →

HIGHNATOB2

Swiss and European public-sector, utility and transport organisations carried the week's home-region incident load — a land registry offline for days, two Swiss utilities/foundations hit through third parties, an EU transit ransomware and a EUR 1.7M telco enforcement

The home-region incident load this week fell almost entirely on public administration, utilities and transport — the profiled constituency's core — and split into three recognisable shapes.

Direct public-sector disruption. Romania's National Agency for Cadastre and Real Estate Publicity (ANCPI) — the authority running the national land-registry and cadastre systems (e-Terra, RENNS) used by citizens, notaries and banks — had all IT systems offline from 14 July after a confirmed cyberattack; a data-leak operator using the alias ByteToBreach (tracked by KELA) claims to have stolen citizen data and the e-Terra/RENNS source code from a copied GitLab server, deployed ransomware and begun deleting backups, which ANCPI disputes (Help Net Security, 2026-07-16). Portugal's Metro Mondego confirmed a 6 July ransomware attack on internal systems — claimed by TheGentlemen — that its IT/OT separation kept off the Metrobus service, a clean example of segmentation limiting blast radius (Campeão das Províncias, 2026-07-17).

Swiss organisations hit through their suppliers. The Basel canton utility IWB (electricity, gas, water, telecom) disclosed that a compromised external service provider exfiltrated ~40,000 customer meter records (names, addresses, meter numbers) — IWB's own systems and supply were unaffected and the Basel-Stadt data-protection officer assessed misuse risk as low (Netzwoche, 2026-07-15). Geneva adult-education foundation IFAGE was listed by DragonForce claiming 850 GB, layered onto a narrower April breach it had already disclosed — single-sourced and unconfirmed, a watch item rather than an established breach.

Enforcement and cross-border tax-data exposure. Italy's Garante fined Wind Tre EUR 1,715,600 with an unusually complete technical account: retail-staff vishing led to valid MFA'd access, then a pivot from a protected primary API to an unprotected secondary API and ~2 million sequential customerId requests exfiltrating 365,048 customers (Garante, 2026-07-16). Ernst & Young separately disclosed a third-party ITSM-platform breach exposing client tax data.

Builds on: 2026-07-19/ancpi-romania-cadastre-cyberattack-bytetobreach · 2026-07-16/iwb-basel-third-party-provider-breach-40k-customer-records · 2026-07-14/dragonforce-leak-claim-ifage-geneva-adult-education · 2026-07-18/metro-mondego-thegentlemen-ransomware-portugal-transit · 2026-07-17/garante-wind-tre-vishing-api-enumeration-fine · 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · 2026-07-17/abacus-erp-unauth-rce-path-traversal-ncsc-ch

synthesis19 Jul 23:50Zmulti-sourceOpen finding ↗
Sources: Help Net Security · Garante per la protezione dei dati personali (Provvedimento n.348) · Netzwoche · Campeão das Províncias (relaying Metro Mondego)

2026-07-19 · view entry permalink →

NOTABLEexploitedupdateNATOB2

The Gentlemen (Storm-2697) status: ReliaQuest's Q2 2026 numbers put it ahead of Qilin on the ransomware leaderboard, and a European public-transport victim (Metro Mondego) landed this week

UPDATE · originally covered The Gentlemen (Storm-2697) status update — Unit 42's full profile: 580 victims, a Qilin-affiliate lineage, and a suspected EDR-disable zero-day (2026-07-12)

The prior weekly carried Unit 42's full profile of The Gentlemen (Storm-2697) — 580 claimed victims, a Qilin-affiliate lineage, a 90% affiliate payout and a suspected EDR-disable zero-day. This week the status change is quantitative and reaches the constituency. ReliaQuest's Q2 2026 threat-spotlight reports The Gentlemen "became the most-active group, powered by aggressive affiliate recruitment and a well-packaged intrusion kit" — 300 victims in Q2 against Qilin's 289 — with affiliates receiving pre-compromised victim lists, custom EDR killers and GPO-based deployment tooling, and a "likely AI-accelerated iteration layer" letting the operators refresh tooling faster than human-developer rivals (ReliaQuest, 2026-07-16); Infosecurity Magazine independently corroborates the 300-vs-289 figures (Infosecurity Magazine, 2026-07-17). GuidePoint GRIT's pre-window Q2 review sets the same concentration in context — its "four-headed monster" is Qilin, The Gentlemen, Akira and DragonForce, and it reports the five most prolific groups collectively claimed over 40% of recorded Q2 attacks (Cybersecurity Dive on GuidePoint GRIT, 2026-07-09). Operationally, the group's claimed 6 July attack on Portugal's Metro Mondego — contained to internal systems, transport unaffected — is the fresh European public-sector datapoint. The initial-access funnel (the tracked FortiOS path and opportunistic edge exploitation) is unchanged; the practical takeaway for the constituency is that the most-active RaaS operator of the quarter is one already on its radar, now recruiting and tooling harder, so the FortiOS/edge and EDR-killer hunt posture the earlier coverage set remains the right one.

The Gentlemen became the most-active group, powered by aggressive affiliate recruitment and a well-packaged intrusion kit

ReliaQuest 2026-07-16

Builds on: 2026-07-18/metro-mondego-thegentlemen-ransomware-portugal-transit

synthesis19 Jul 23:36Zmulti-sourceOpen finding ↗
Sources: ReliaQuest · Infosecurity Magazine · Cybersecurity Dive (on GuidePoint GRIT Q2 2026)

Earlier coverage (24)

2026-07-18NOTABLENATOB2TheGentlemen ransomware hits Portugal's Metro Mondego (Coimbra light-rail); operator confirms attack, notifies CNCS and CNPDMetro Mondego, the public operator of the Metrobus light-rail service between Lousã and Coimbra (Portugal), confirmed on 2026-07-17 that a ransomware attack on 6 July affected part of its internal systems without compromising transport operation. The RaaS group TheGentlemen (Microsoft: Storm-2697) claimed the attack and data theft on its leak site. Metro Mondego activated incident response with external experts and notified Portugal's national cyber authority (CNCS), the data-protection authority (CNPD) and criminal investigators; it cannot yet confirm whether personal data was copied, but says passenger payment data was not affected. A clean EU public-transport incident showing IT/OT segmentation holding.2026-07-12NOTABLENATOB2Looking ahead — 2026-W28Items already in motion, not predictions: the Dutch NIS2 Cyberbeveiligingswet enters into force 15 August 2026 (five weeks out) and the EU Cyber Resilience Act's 11 September vulnerability/incident-reporting obligation is ~60 days away; FINMA's post-quantum expectation-setting may harden into a binding circular; the Joomla extension file-upload wave's newest members (RSFiles!/Phoca) are patched but not yet exploited, and prior wave members reached CISA KEV within days; Unit 42 references an Expel write-up of The Gentlemen's suspected EDR-disable zero-day that has not yet published; and the STAC3725 initial-access broker continues weaponising CitrixBleed 2 against un-session-terminated NetScaler.2026-07-12NOTABLEupdateNATOB2The Gentlemen (Storm-2697) status update — Unit 42's full profile: 580 victims, a Qilin-affiliate lineage, and a suspected EDR-disable zero-dayUnit 42 published (2026-07-10) the first full technical profile of The Gentlemen RaaS (Microsoft: Storm-2697), which this pipeline has tracked since May. New this week: 580 claimed victims across 77 countries through 3 July (a ~6x H2-2025-to-H1-2026 increase), an assessed lineage from 'ArmCorp' — an affiliate of Qilin — before the ~September 2025 rebrand to a 90%-payout RaaS, initial-access vectors now explicitly including Erlang/OTP SSH and Windows SMB flaws alongside the tracked FortiOS/FortiProxy path, and a third-party (Expel) report of a suspected zero-day used specifically to disable EDR, distinct from the previously-documented GentleKiller BYOVD framework.2026-06-29HIGHThe GentlemenThe Gentlemen ransomware makes Switzerland the second-most-targeted European country, claims 478 victims and adds worm propagation — ESET's leaked-data deep-dive shows victims are chosen on FortiGate misconfiguration, tying the pipeline to FortiBleed reconnaissance. (daily 06-27, inside-it.ch)2026-06-29NOTABLEESET "Killing me gently" — a de-facto mid-year RaaS-tooling reportBackground. The Gentlemen emerged in late 2025 as a RaaS operation founded by "hastalamuerte" (a former Qilin affiliate per Group-IB, previously affiliated with Embargo, LockBit, Medusa and BlackLock per PRODAFT).2026-06-27HIGH"The Gentlemen" ransomware claims 478 victims and adds worm propagation — Switzerland the second-most-targeted European country"The Gentlemen" ransomware: Switzerland is the second-most-targeted European country (Check Point data via Swiss press), against a group profile of 478 claimed victims and an SMB --spread worm capability (inside-it.ch, 2026-06-26).2026-06-22NOTABLECheck Point State of Ransomware Q1 2026 — ecosystem consolidation, with Switzerland and Germany namedSurfaced this week for its CH/EU-specific findings, Check Point's Q1 2026 ransomware report (published 11 May, not covered in the dailies) documents a structural consolidation: the top 10 groups now hold 71.1% of all leak-site victims, the highest concentration since early 2024 and a reversal of two years of …2026-06-22NOTABLEEnergy, water & OT — perimeter and process failures, with an OT-adjacent haltCritical-infrastructure exposure ran from cyber intrusion to physical mishandling.2026-06-22HIGHThe Gentlemen — EDR-killer framework documented, OT-adjacent victim claimed, operator namedThe Gentlemen RaaS grew +315% in Q1 and impacted OT — ESET exposed its centrally-built GentleKiller EDR-killer; the gang halted milling at Mackay Sugar. (daily 06-19, ESET)2026-06-20NOTABLEThe Gentlemen (Storm-2697) claims OT-adjacent Mackay Sugar attack; operator attributed to a Russian nationalUPDATE (originally covered 2026-06-19): Following ESET's 2026-06-19 documentation of the group's GentleKiller EDR-killer framework, The Gentlemen ransomware group has claimed an OT-adjacent attack on Mackay Sugar (Australia's second-largest sugar producer), which confirmed on 2026-06-18 that an external party …2026-06-19NOTABLEESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer frameworkESET's months-long investigation into the Gentlemen ransomware-as-a-service operation reveals a structural departure from the affiliate norm: rather than each affiliate sourcing its own evasion tooling, the operators build, maintain and distribute a modular EDR-killing framework — GentleKiller — centrally (ESET …2026-06-12HIGHThe Gentlemen ransomware: 478 claimed leak-site victims, self-propagating Go encryptor, operator publicly namedThe Gentlemen RaaS claims 478 leak-site victims (concentrated in Thailand, the UK, Brazil, Germany and India per THN); Krebs publishes an operator deanonymisation, and Microsoft's dissection details the encryptor's --spread worm mode (KrebsOnSecurity, 2026-06-10).2026-05-29NOTABLEexploitedThe Gentlemen ransomware — Microsoft publishes full technical dissection of the Storm-2697 Go-encryptorUPDATE (originally covered 2026-05-20; consolidated in weekly W21): Microsoft Threat Intelligence published a full dissection of The Gentlemen ransomware on 2026-05-28, giving Storm-2697 a much sharper technical profile than the victim-list reporting available in week 21.2026-05-25HIGHThe Gentlemen / Storm-2697 — internal "Rocket" backend leaked by a rival; KELA and Check Point dissect the operator inner circleMost active RaaS exposed — The Gentlemen's internal database leaked. A rival dumped the operation's "Rocket" backend; KELA and Check Point analysis exposes the operator inner circle and an initial-access playbook (Fortinet/Cisco edges, NTLM relay, GPO deployment) that maps straight to hunts. (daily, Check Point)2026-05-25NOTABLECheck Point Q1 2026 State of Ransomware — ecosystem reconsolidates; LockBit returns with a deliberate Europe pivotHorizon research surfaced a quarterly report the dailies did not cover: Check Point's Q1 2026 State of Ransomware (published 2026-05-11).2026-05-23NOTABLERapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 daysRapid7 Labs published its Q1 2026 Threat Landscape Report on 2026-05-21 covering January–March 2026 IR data; the GlobeNewswire release accompanied the post the same day. The findings that change what a Swiss/EU public-sector SOC should prioritise:2026-05-18NOTABLEThe Gentlemen RaaS — Czech university and Swiss engineering firm listed; comms overhaul continuesThe Gentlemen RaaS listed two new European victims — the University of Finance and Administration (Czech Republic) and a Swiss engineering firm — on its leak site (daily 2026-05-20).2026-05-14HIGHThe Gentlemen RaaS — backend "Rocket" database leaked (16.22 GB), Check Point analysis exposes operator handles, ZeroPulse C2 internals, 1,570+ victims, decryptor published on GitHubThe Gentlemen RaaS backend dumped — Check Point exposes operator handles and tooling; SystemBC C&C reveals 1,570+ victims vs. 332 on the public leak site; decryptor on GitHub. Check Point Research's 2026-05-13 analysis of a 44.4 MB extract from the group's leaked "Rocket" backend (16.22 GB total, posted to the cybercrime forum Breached on 4 May after the group's infrastructure was compromised) maps nine operator handles, the EDR-suppression toolchain (EDRStartupHinder, gfreeze, glinker), the ZeroPulse C2 framework, and a separately-exposed SystemBC C&C server holding 1,570+ victim entries against 332 publicly listed in the first five months of 2026 — large under-reporting of true scope. The decryptor is public on GitHub per BankInfoSecurity, making decryption the first action for any in-flight Gentlemen incident (Check Point Research, 2026-05-13; BankInfoSecurity, 2026-05-11).2026-05-11NOTABLELooking ahead — 2026-W20Microsoft Exchange CVE-2026-42897 — Microsoft permanent patch and out-of-band advisory on DEVCORE Pwn2Own three-bug chain pending.2026-05-11NOTABLE"The Gentlemen" RaaS — operations continue post-leak, decryptor published, FortiOS / Erlang SSH initial access CVEs confirmedFollowing the 2026-05-04 Rocket backend DB leak (attributed to a breach of hosting provider 4VPS), administrator zeta88 / hastalamuerte announced a full communications-infrastructure overhaul — new NAS deployment and new locker upgrades — signalling no intent to cease operations.2026-05-11NOTABLECheck Point April 2026 ransomware analysis — Qilin leads at 15%, Germany at 5% of global victimsCheck Point's April 2026 monthly threat report (published early May 2026) confirms Qilin / Agenda leading all ransomware operators with 15% of 707 published attacks in April; Germany is the third-most-targeted country globally at 5.0% of victims (US 41.6%); Europe accounts for 27% of ransomware victims globally.2026-05-04NOTABLELooking ahead — 2026-W19Canvas / Instructure extortion deadline — Tuesday 2026-05-12 (two days out). Second-intrusion claim against Instructure made 2026-05-08 despite the May 8 patches; seven Dutch universities disconnected; Dutch DPA and ICO engaged.2026-05-04NOTABLEAkira playbook quarterly context — Q1 2026 healthcare concentration; Qilin remains the dominant operator on German healthcare victimsW1 horizon research added Q1 2026 healthcare quarterly context to the Groupe 3R item in § 1.2026-05-04NOTABLEexploitedThe Gentlemen RaaS — Europe-skewed operation surged approximately 448% QoQ; 32% of Q1 2026 victims in Europe; FortiGate CVE-2024-55591 initial-access funnelW1 horizon research identified an in-window operator gap the daily briefs missed.