A fresh assessment of The Gentlemen operation has revealed that this financially driven threat group originally functioned as an affiliate carrying out double extortion attacks, utilizing resources from multiple ransomware-as-a-service (RaaS) programs, including LockBit (also referred to as Tenacious Mantis), Qilin (known as Pestilent Mantis), and Medusa (also called Venomous Mantis).
Based on a comprehensive report released by PRODAFT, the group—which they monitor under the name Phantom Mantis—is headed by a Russian-speaking cybercriminal designated as LARVA-368, who uses the online aliases hastalamuerte, ArmCorp, zeta88, nobody0, and santamuerte. The Gentlemen has been operational since March 2025, with a total of 478 victims claimed to date, according to data from Ransomware.Live.
"In July 2025, Phantom Mantis evolved into The Gentlemen, an independent partnership program no longer reliant on other RaaS groups," the Swiss cybersecurity firm stated. "Furthermore, LARVA-368 depends heavily on artificial intelligence for creating and maintaining ransomware and tools, as well as for aiding in post-exploitation processes."
Regarding LARVA-368, the threat actor is believed to have been a participant in the Embargo (also known as Primeval Mantis) ransomware group prior to launching their own venture under the name ArmCorp. This was later rebranded to The Gentlemen four months afterward.
The individual's identity has since been revealed by cybersecurity journalist Brian Krebs as a 36-year-old Alexander Andreevich Yapaev (Япаев Алексанр Андреевич) from the Russian city of Izhevsk. PRODAFT informed The Hacker News that its findings correspond to the same persona with "high confidence."
As outlined by Dark Atlas in August 2025, the transition coincided with a payment conflict between LARVA-368 and Qilin, where the threat actor accused the RaaS operation of executing an exit scam and cheating them out of $48,000.
"Although Phantom Mantis was a highly active affiliate group with over 20 targets listed on its affiliate panel in under 30 days, the group's administrator (LARVA-368) and LARVA-367 (also known as DevMan), a former Phantom Mantis member, claimed that Pestilent Mantis was defrauding affiliates and that there was an alleged 'backdoor' within the Pestilent Mantis affiliate panel victim chats," PRODAFT noted.
"While we could not verify these allegations, there is a possibility that LARVA-368 and LARVA-367 intentionally spread misinformation with the aim of recruiting Pestilent Mantis affiliates to Phantom Mantis by discrediting the group."
Phantom Mantis has also been seen purchasing Premium accounts on underground forums to enhance their visibility and deter competition, with the group's communication and technical support managed by a separate Russian-speaking persona called The Gentlemen Data.
Other notable aspects of the extortion scheme compiled from various reports include the following:
In an analysis of the ransomware from late last year, LevelBlue's Cybereason team characterized The Gentlemen as a "highly adaptive, fast-moving ransomware operation" that merges mature ransomware techniques with RaaS features, double extortion, cross-platform lockers, flexible propagation, and affiliate support.
The group has become one of the most active threat actors, representing 10% of ransomware activity in April 2026. "The Gentlemen follows an enterprise-focused chain beginning with initial access, via vulnerable internet-facing services or stolen credentials," NCC Group stated. "Analysis suggests The Gentlemen can adapt and shift tactics during an attack, such as manipulating GPOs, compromising privileged accounts, and using custom methods to bypass endpoint protections."
Only about 13% of their victims are located in the U.S. The majority of victims are concentrated in Thailand, the U.K., Brazil, Germany, and India.
LARVA-368 uses The Gentlemen IM app accounts to assist affiliates with encryption and any intrusion-related issues, such as providing EDR killers to bypass security solutions through the bring your own vulnerable driver (BYOVD) technique.
Support services for both The Gentlemen and The Gentlemen Data are available via Tox, SimpleX Chat, and Ricochet Refresh open-source messaging platforms.
Potential affiliates are required to provide the administrator with at least 1GB of data exfiltrated from a victim to gain access to the affiliate panel, a strategy designed to prevent researchers and law enforcement from infiltrating the infrastructure under the guise of an affiliate. The affiliate panel supports user management, configuring new targets, and downloading ransomware to a specific target.
Phantom Mantis offers five versions of ransomware designed for Windows, Linux, ESXi, Windows XP+, and Logical Volume Manager (LVM).
The group attracts affiliates with an aggressive profit-sharing model: 90% for affiliates and 10% for the operator.
Initial access is gained through edge devices such as VPN appliances, firewalls, and other internet-facing systems, with a particular focus on platforms like Cisco and Fortinet FortiGate.
Infection chains involve the use of red team utilities like NetExec, RelayKing, TaskHound, PrivHound, and CertiHound for Active Directory discovery, certificate abuse, privilege escalation, and file share discovery. A separate set of tools, such as EDRStartupHinder, gfreeze, glinker, and DumpBrowserSecrets, are used for evading security programs, while Velociraptor is employed for command-and-control (C2).
The attacks also attempt to clear System, Application, and Security Windows Event Logs, disable Microsoft Defender, and add antivirus exclusions.
The ransomware uses a hybrid cryptographic scheme: X25519 key exchange combined with XChaCha20 symmetric encryption.
Microsoft, which tracks the cluster under the name Storm-2697, stated that the ransomware is written in Go and obfuscated with Garble to target the Windows environment. "When enabled with the --spread argument, it turns the malware from a single-host encryptor into a self-propagating worm that attempts to deploy its encryptor to every reachable system on the network," the tech giant said. "If the --wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine to eliminate recoverable artifacts from disk."
According to ZeroFox, the ransomware crew likely runs a multi-channel extortion operation, combining ransomware attacks with email outreach and phone-based pressure tactics targeting victims.
The group implements a "highly responsive development cycle," an aspect exemplified by the release of a same-day patch after a decryptor was released in April 2026.
The average dwell time of an intrusion ranges from two to six weeks from initial access to encryption, with the group particularly focusing on organizations running VMware infrastructure.
Last month, a leak of an internal Rocket.Chat database used by the group—comprising 3,366 messages from November 2025 to late April 2026—has provided further insight into the group's internal operations, including its use of known security flaws in VMware Aria Operations, Fortinet, Cisco, and Microsoft software, while painting a picture of a criminal enterprise whose members have a clear division of roles and responsibilities.
"The group actively tracks and evaluates modern vulnerabilities, including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, and combines them with technique-driven paths like backup and management-controller abuse and NTLM relay workflows, giving them a flexible exploitation pipeline," Check Point said.
That's not all. In March 2026, Hunt.io reported discovering an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 that exposed 126 files containing a complete ransomware operator toolkit attributed to a The Gentlemen RaaS affiliate.
This included tools for reconnaissance, privilege escalation, defense evasion, credential theft, lateral movement, persistence, and pre-encryption preparation, essentially covering all phases of the intrusion lifecycle.
"LARVA-368 is a threat actor specializing in extortion-related activities and has been active since at least 2020," PRODAFT said. "The expertise acquired through previous collaborations with various RaaS groups provided the technical foundation necessary to establish The Gentlemen RaaS."