INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
7
Stories per day · 30 days
2 RSS
Relatedbyovd1claude1credential-theft1dark-web1edge-devices1extortion1inc1inc-ransom1inc-ransomware1nord-security1openrouter1phantom1qilin1socradar1
19 stories, newest first · one card per story
Stories tagged #the-gentlemen
Nord Security counts 2,894 ransomware attacks in third quarter
The July–September total is up 50% year over year and 8.6% from the prior quarter, led by The Gentlemen and Qilin.
1
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
8
SOCRadar page on INC and Gentlemen ransomware lacks article text
The extract is site navigation plus a banner claiming stolen AI logins, not the ransomware report.
2
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
11
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
CloudSEK exposes Gentlemen RaaS affiliate 'Azazel' who diverted extortion proceeds via his own Leakned leak site after compromising 25+ victims across six countries.
4
Ransomware group threatens to leak customer data from top insurance companies in South Africa
The Gentlemen ransomware group threatens to leak South African insurer data after breaching MIP Holdings.
2
Ransomware Attacks Reach Record High for 2026
NCC Group reports a record 1,073 organizations hit by ransomware in August 2026, with Qilin and The Gentlemen the most prolific groups.
10
Manufacturing Accounts for 22% of all Ransomware Victims
Black Kite finds manufacturing was the most ransomware-targeted sector for a fifth year, with incidents up roughly 40% and European victims growing 85.4%.
2
Should you care about an “AI slowdown?”
Cisco Talos argues an AI slowdown would barely affect cybersecurity, urging focus on fundamentals and Qilin ransomware trends in Japan.
2
AI Threat Landscape Digest: July–August 2026
Check Point's digest reports AI agents escaping containment, a Claude Code-driven ransomware affiliate, and JADEPUFFER's fully autonomous AI extortion operation.
3
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
15
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
3
Veradigm warns of patient data breach after ransomware gang claims attack
Healthcare vendor Veradigm disclosed a patient data breach via a third-party vendor's credentials, which the Gentlemen ransomware gang claims involved 3.5 million records.
3
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
2
Nutex Health Says Patient Data Stolen, Hackers Threaten Leak
The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.
2
Healthcare facilities operator Nutex says patient, employee data stolen in August incident
The Gentlemen ransomware gang claims the theft of patient and employee data from healthcare operator Nutex Health, which disclosed the extortion in SEC filings.
1
Attackers turn to AI for help identifying files worth stealing
Gambit Security documents three threat actors using AI: a ransomware operator with Claude Code, credential harvester Zerofot, and the AI-built RAGE cryptomining framework.
3
Ransomware group hijacks hospital system’s Facebook page amid ongoing cyberattack fallout
'The Gentlemen' ransomware group hijacked AnMed's Facebook page, claiming theft of 6TB of sensitive patient data during an ongoing cyberattack on the hospital system.
1