The Gentlemen RaaS Leak Highlights Infostealer‑Driven Ransomware Operations

Du'aine Davis

Observed in the wild

• In early May 2026, an internal backend database used by The Gentlemen ransomware‑as‑a‑service operation was leaked, exposing chats, affiliate activity and victim data. The material reveals ongoing global ransomware campaigns, including a publicly disclosed breach of a UK software consultancy, with stolen credentials and internal data later reused to facilitate follow‑on attacks against a company in Turkey, intensifying cross‑victim extortion pressure.
• The leak shows The Gentlemen rely heavily on infostealer‑derived credential logs for initial access, alongside exposed VPN and edge infrastructure. Affiliates actively search credential‑dump databases (for example, infostealer log aggregators) to identify valid OWA/M365 and VPN credentials, using these as low‑noise entry points before lateral movement, EDR evasion, data exfiltration and ransomware deployment. Dedicated affiliates are tasked specifically with credential‑log exploitation.
• Organisations are advised to treat historic infostealer exposure as a ransomware risk. Prioritise forced credential resets, MFA enforcement for Microsoft 365, VPNs and cloud admin accounts, and continuous monitoring for anomalous sign‑ins in Microsoft Defender. Defender alerts tied to credential replay, suspicious login geographies, legacy auth use, ETW tampering or unauthorised Defender exclusions should be investigated as potential precursors to hands‑on ransomware activity.

How The Gentlemen Ransomware Group Operates: A Blueprint Built on Infostealer Credentials | InfoStealersThus Spoke…The Gentlemen - Check Point Research