The Gentlemen Ransomware: Global Manufacturing Disruption and Custom Tooling (June 2026)

The Gentlemen Ransomware: What Happened

Between mid-2025 and mid-2026, The Gentlemen ransomware group executed a global campaign targeting organizations across 77 countries, with a pronounced focus on the manufacturing sector. This Ransomware-as-a-Service (RaaS) operation leveraged a high affiliate payout model to rapidly expand its reach, resulting in over 580 confirmed victims. The group’s activities included the deployment of custom backdoors and an EDR killer framework, enabling them to bypass security controls and maintain persistent access. Notably, 103 manufacturing firms experienced operational downtime, highlighting the group’s capability to disrupt critical industrial processes at scale.

Attack Vector & Technical Detail

The Gentlemen ransomware group utilized a combination of zero-day exploits and custom malware tooling to infiltrate enterprise environments. Key vulnerabilities exploited in these campaigns included CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, and CVE-2025-7771. The attackers demonstrated proficiency in leveraging multiple initial access vectors, including spear-phishing and exploitation of exposed services, aligning with MITRE ATT&CK tactics TA0001 (Initial Access), TA0006 (Credential Access), TA0007 (Discovery), TA0008 (Lateral Movement), and TA0040 (Impact). The presence of the PrinzEugen leak site (Tor) was noted as a key IOC, indicating the group’s use of double extortion tactics to pressure victims into payment.

Confirmed Impact

The campaign resulted in significant operational disruption, particularly within the manufacturing sector, where 103 firms experienced downtime affecting production and supply chains. The breadth of the attack—spanning 77 countries—underscores the global reach and sophistication of The Gentlemen’s operations. The use of zero-day vulnerabilities and custom EDR evasion tools presents a heightened threat to enterprise infrastructure, with potential regulatory implications for organizations subject to data protection and critical infrastructure mandates. The scale and speed of victimization suggest that many organizations lacked adequate segmentation and patch management controls.

What This Means for Your Organization

The Gentlemen’s reliance on both known and zero-day vulnerabilities, combined with advanced tooling, signals a need for organizations to reassess their exposure to unpatched systems and credential theft techniques. Manufacturing and industrial firms should prioritize network segmentation and rapid patch deployment, especially for externally facing assets. The group’s use of a RaaS model means even less sophisticated affiliates can launch damaging attacks, increasing the likelihood of opportunistic targeting. Proactive monitoring for unusual lateral movement and the presence of custom malware is essential to early detection and containment.

Detection & Response

• Immediate: Audit and isolate systems vulnerable to CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, and CVE-2025-7771. Review EDR logs for signs of tampering or evasion.
• Hunt: Search for indicators related to the PrinzEugen leak site (Tor) and anomalous credential access or lateral movement consistent with MITRE tactics TA0006 and TA0008.
• Patch: Apply vendor-supplied updates for all listed CVEs immediately. Prioritize patching of internet-facing and critical infrastructure systems.

Source: https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/