US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
Threat actor
The Gentlemen
- Mentions · 7d4
- Mentions · 30d18
- All mentions34
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
34 articles · newest firstUnit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
78
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
74
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
Nord Security counts 2,894 ransomware attacks in third quarter
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
62
Ransomware affiliates using Claude left chats and tools exposed
SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.
78
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
72
SOCRadar page on INC and Gentlemen ransomware lacks article text
The extract is site navigation plus a banner claiming stolen AI logins, not the ransomware report.
12
MITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
61
MITRE ATT&CK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft
MITRE ATT&CK v20 adds Enterprise techniques for prompt injection, AI exfiltration and result poisoning.
63
KFC Named in Gentlemen Ransomware Group’s Latest Breach Claim
The Gentlemen ransomware group listed U.S. KFC on its leak site, but the October 2026 claim remains unverified.
52
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
55
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
CloudSEK exposes Gentlemen RaaS affiliate 'Azazel' who diverted extortion proceeds via his own Leakned leak site after compromising 25+ victims across six countries.
65
Ransomware group threatens to leak customer data from top insurance companies in South Africa
The Gentlemen ransomware group threatens to leak South African insurer data after breaching MIP Holdings.
71
Social Engineering in the Age of Synthetic Media
Recorded Future details how threat actors abuse jailbroken and legitimate AI tools to scale phishing, deepfake impersonation, and phishing-as-a-service operations.
55
Ransomware Attacks Reach Record High for 2026
NCC Group reports a record 1,073 organizations hit by ransomware in August 2026, with Qilin and The Gentlemen the most prolific groups.
62
Manufacturing Accounts for 22% of all Ransomware Victims
Black Kite finds manufacturing was the most ransomware-targeted sector for a fifth year, with incidents up roughly 40% and European victims growing 85.4%.
65
Should you care about an “AI slowdown?”
Cisco Talos argues an AI slowdown would barely affect cybersecurity, urging focus on fundamentals and Qilin ransomware trends in Japan.
28
AI Threat Landscape Digest: July–August 2026
Check Point's digest reports AI agents escaping containment, a Claude Code-driven ransomware affiliate, and JADEPUFFER's fully autonomous AI extortion operation.
78
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
55
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
62
ShinyHunters expose 6.4M in attack on medical supplier McKesson
ShinyHunters leaked stolen McKesson data exposing roughly 6.4 million individuals after the medical supplier reportedly declined a $55.2 million extortion demand.
78
Electronic health record company says customer data stolen in breach
Veradigm disclosed that attackers used stolen vendor credentials via an API to steal patient data including Social Security numbers, as the Gentlemen ransomware gang claims 3.5 million patients' records.
78
Veradigm warns of patient data breach after ransomware gang claims attack
Healthcare vendor Veradigm disclosed a patient data breach via a third-party vendor's credentials, which the Gentlemen ransomware gang claims involved 3.5 million records.
76
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
72
Nutex Health Says Patient Data Stolen, Hackers Threaten Leak
The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.
65
Healthcare facilities operator Nutex says patient, employee data stolen in August incident
The Gentlemen ransomware gang claims the theft of patient and employee data from healthcare operator Nutex Health, which disclosed the extortion in SEC filings.
62
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
Opinion piece argues attackers prioritize repeatable playbooks like ClickFix (47% of Microsoft-notified attacks) and living-off-the-land over novel techniques.
28
Attackers turn to AI for help identifying files worth stealing
Gambit Security documents three threat actors using AI: a ransomware operator with Claude Code, credential harvester Zerofot, and the AI-built RAGE cryptomining framework.
65
Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout
'The Gentlemen' ransomware group hijacked AnMed's Facebook page, claiming theft of 6TB of sensitive patient data during an ongoing cyberattack on the hospital system.
58
Related CVEs
by mentions- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2026-908289%9.8Actively Exploited SQL Injection in Drupal Core
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-1102641%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
Appears with
- Qilinthreat actor · 15
- INCthreat actor · 5
- Inc Ransomthreat actor · 5
- SECorganization · 4
- SOCRadarorganization · 4
- Fortinetvendor · 4
- ShinyHuntersthreat actor · 4
- FortiClient EMSproduct · 3
- Clopthreat actor · 3
- Veradigmvictim · 3
- Microsoftvendor · 3
- RevSocksmalware · 3
- Akirathreat actor · 3
- Veradigmvendor · 3
- SafePaythreat actor · 3
- DragonForcethreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.