The Gentlemen
RaaS operation offering affiliates 90% revenue share; second-most-active globally as of May 2026.
The Gentlemen posted 106 victim claims in September 2026, the most of any ransomware CREW on ransomware.live's count, while Qilin, the group it split from in July 2025, fell to 74.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Is The Gentlemen about to overtake the world's most active ransomware group?
Timeline for The Gentlemen
Took first place on 106 September claims
Cybersecurity: Threats and Defences: Ransomware crews' claims fall to 815Fell from 137 to 116 claims and from first to second place
Cybersecurity: Threats and Defences: Ransomware claims rose 11 per cent in AugustPosted 31 leak-site victims between 24 July and 3 August, more than Qilin
Cybersecurity: Threats and Defences: Qilin's own affiliate now outposts itMicrosoft patches domain controller reboot loops
Cybersecurity: Threats and DefencesBackground
The Gentlemen is a ransomware-as-a-service operation that began inside Qilin's own affiliate programme under the handle ArmCorp. It split off around 22 July 2025 after a dispute over roughly $48,000 in unpaid revenue share; a Windows ransomware sample from the new operation had appeared on VirusTotal five days earlier, on 17 July 2025. Group-IB, the Singapore-based investigations firm, documented the split on 19 March 2026 and put the group at roughly 20 members.
Group-IB puts the affiliate share at 70 to 80 per cent. Ransomware.live's tracker profile puts it at 90 per cent. The two figures rest on different evidence, investigative analysis against a leak-site aggregator's figures, and either sits among the highest reported in the market.
Check Point Research infiltrated a SystemBC command server used by the group's affiliates and found 1,570 confirmed victims, and by 6 May 2026 ranked The Gentlemen the second-most-active ransomware operation in the world. Its rise against Qilin is the clearest case of an affiliate turning a payment dispute into a rival brand.
The Gentlemen overtakes its former parent
Leak-site postings tracked by ransomware.live between 24 July and 3 August 2026 put The Gentlemen at 31 victims against Qilin's 19. That was a ten-day window, and Qilin retook first place in August with 165 claims on ThreatVectr's count.
September gave The Gentlemen a firmer lead. Ransomware.live recorded 815 claims across all crews, down from 1,060 in August, and The Gentlemen led with 106 while Qilin's total more than halved to 74. Late postings could still lift the September figures, and the trackers count on different bases, so the ranking reflects leak-site claims rather than confirmed attacks.
