The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm

Summary: PRODAFT reports that The Gentlemen, tracked as Phantom Mantis and led by a Russian-speaking actor it calls LARVA-368, began as an affiliate for LockBit, Qilin, and Medusa before becoming an independent operation in July 2025, and has claimed 478 victims since March 2025 per Ransomware.Live. A leaked Rocket.Chat database of 3,366 messages from November 2025 to late April 2026 showed the group exploiting flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, while journalist Brian Krebs identified LARVA-368 as 36-year-old Alexander Andreevich Yapaev of Izhevsk.
Bottom line: The group's shift to independence followed a payment dispute in which LARVA-368 accused Qilin of an exit scam and $48,000 in losses, and Hunt.io found 126 files of a complete operator toolkit, from reconnaissance to pre-encryption, exposed on Proton66 hosting in March 2026.

Read the original at The Hacker News ↗

Topics: Ransomware
Mentions: CVE-2024-55591 CVE-2025-32433 CVE-2025-33073
Related: Gunra Ransomware Exploits Fortinet FortiOS, Forti Proxy Flaws to Breach Networks Cyber Risks ·
CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability Known Exploited Vulnerabilities · Oct 20, 2025
CVE-2025-32433: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 09, 2025