Over the past seven days, DefendEdge’s threat intelligence platform ingested 918 attack records from around the world. One ransomware operation accounts for more than a tenth of them. Tracked attacks attributed to The Gentlemen — a financially motivated ransomware crew that runs a leak-site extortion model — jumped from 36 the week before to 107 this week, a 197 percent surge that makes it the single most active threat actor on our radar right now. While security researchers were publicly dismantling one of its affiliate operations piece by piece, the group’s output did not slow down. It nearly tripled.
An Affiliate Drama, Exposed in Public
The timing of the surge is remarkable. CloudSEK’s recently published investigation, Caught in 4K: The Gentlemen Files, documents a Russian-speaking affiliate of the group, tracked under the alias Azazel, who is believed to have attacked roughly two dozen victims across six countries — and then double-crossed his own gang by publishing the stolen data on a private leak site and pocketing the ransom payments himself. CloudSEK traced roughly 50 terabytes of exposed infrastructure belonging to the affiliate and, more striking still, documented a live, AI-driven attack chain in which the operator leaned on AI tooling to accelerate portions of the intrusion.
Two things stand out for defenders. First, ransomware today is a franchise business, and disputes inside the franchise spill into public view with operational details attached. Second, the barrier to running a competent intrusion keeps dropping — an affiliate mid-operation was actively using AI-driven tooling to move faster. Neither fact appears to have slowed The Gentlemen down. If anything, the week of their public exposure coincided with the most productive week we have recorded for the group.
The Week in Numbers: A 197 Percent Surge
Platform data for the trailing seven days shows ransomware dominating the threat landscape: 296 ransomware records, ahead of command injection at 105, zero-day exploitation at 41, and data breaches at 41. The Gentlemen’s 107 tracked attacks sit on top of that pile — more than any other actor we monitor, ahead of crews that have operated at far greater notoriety for far longer.
The sector picture underneath those numbers is familiar and unforgiving. Healthcare absorbed 72 tracked attacks platform-wide this week, finance 66, government 82, and retail 43. The Gentlemen’s own targeting followed the money and the soft edges: 25 of its 107 attacks hit healthcare, 14 hit finance, and 8 hit manufacturing — three sectors that consistently hold data that cannot tolerate downtime, which is exactly what extortion economics rewards. As we noted in last week’s analysis, healthcare’s exposure is not a spike; it is a sustained campaign, and this group is now one of its primary drivers.
Injection First, Encryption Second
The most operationally useful detail is how the group gets in. BlackBeam currently tracks 22 verified indicators of compromise associated with The Gentlemen. Among them: server-side template injection (SSTI) probe URLs with embedded out-of-band callback addresses — the kind of URL an attacker uses to confirm that a web application renders attacker-supplied templates and will execute code — plus a known malicious file hash and the group’s .onion leak site. One tracked probe URL embeds a classic SSTI validation payload, attempting to render the output of a system command and exfiltrate it to a remote callback service before the attacker commits to a full intrusion.
The group’s weekly attack mix confirms the pattern: 47 ransomware incidents were accompanied by 23 command-injection events and one man-in-the-middle record. That ratio tells a story. The Gentlemen’s ransomware does not begin with ransomware. It begins with an injection flaw on an internet-facing application — the same class of weakness that made command injection the second-largest attack type we recorded this week, at 105 incidents. By the time encryption starts, the attacker has already proven code execution, staged tooling, and, in this crew’s case, exfiltrated data for double extortion.
What BlackBeam Is Seeing
This week BlackBeam tracked a 197 percent week-over-week surge in attacks tied to The Gentlemen — from 36 to 107 tracked attacks — concentrated in Healthcare (25 incidents), Finance (14), and Manufacturing (8). The group’s arsenal mixed ransomware deployment (47 incidents) with command injection (23 incidents), and BlackBeam tracks 22 verified IOCs for the actor, including SSTI probe URLs with embedded out-of-band callbacks and the group’s .onion leak-site domain. Over the same seven-day window, BlackBeam processed more than 850,000 wildcard-domain correlation events, continuously matching newly observed domains against tracked threat-actor infrastructure and client watchlists to catch infrastructure spin-up before it is used against a target.
The Gentlemen Are Not Alone: The Week’s Broader Surge
The Gentlemen’s spike is the headline, but the week’s actor-level data shows a broad acceleration. Water Galura climbed 61 percent, from 59 to 95 tracked attacks — almost entirely ransomware. Rhysida tripled its weekly output from 5 to 15, with healthcare its hardest-hit sector at 7 of those attacks. Booba Project more than doubled from 12 to 28, driven almost entirely by data breaches rather than encryption. SafePay also tripled from 5 to 15, weeks after a joint federal advisory on the crew that we covered in our earlier breakdown.
The wider news cycle reinforces the same pattern from different angles. Synology publicly warned customers of C3RB3R ransomware campaigns still exploiting vulnerabilities that were patched in 2024 — a two-year-old flaw set with live victims, a reminder that unpatched edge devices remain the cheapest initial access on the market. More than 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw under active exploitation. Microsoft detailed intrusions in which attackers used Microsoft Teams messages and voice calls to impersonate IT support and persuade employees to approve remote access to their own machines. A supply chain attack served a malicious AI coding extension through the Cursor ecosystem — an extension that performed host reconnaissance and attempted to open a reverse SSH tunnel. And platform operator Northflank urged customers to rotate every secret on the platform after reports of unauthorized AI API key usage, a signal that AI service credentials are now a primary theft target in their own right.
Practical Steps for Organizations
The common thread through the week — injection flaws, unpatched edge systems, social-engineered remote access, and leaked credentials — is that every one of these entry points is visible and defensible before an attacker uses it. Six steps matter most right now:
Patch and inventory internet-facing systems relentlessly. The GitLab figure — more than 1,000 exposed servers still unpatched against an actively exploited, maximum-severity flaw — and the Synology C3RB3R campaigns exploiting two-year-old vulnerabilities describe the same failure mode. Maintain a complete inventory of every internet-facing service, assign it an owner, and treat any service that cannot be patched within your exposure window as an acceptance decision, not an oversight.
Treat command injection as a ransomware precursor, not a separate problem. With 105 command-injection incidents recorded this week — 23 of them tied to the most active ransomware crew on our radar — the injection flaw in your web application is not a low-severity code-quality issue. It is the front door to encryption and extortion. Audit every service that renders templates or passes user input to a shell, add template-injection and OAST-callback detection to your monitoring, and put internet-facing applications behind a web application firewall with injection rules enforced.
Lock down help-desk and remote-access approval flows. The Teams impersonation intrusions Microsoft described succeeded because a convincing voice on a familiar tool asked for access and a human approved it. Require out-of-band verification — a callback through a pre-registered channel — for every remote-access request, and make it a rule that no help-desk session grants elevated access in a single approval.
Rotate and scope AI API keys like they are production credentials. The Northflank incident, with unauthorized AI API key usage, is the template for what happens when these keys leak. Scope every AI key to the narrowest possible permission set, set usage budgets and anomaly alerts, rotate them on a schedule, and never expose them in environment variables or shared configuration that a compromised dependency could read.
Vet developer tooling and its supply chain. A malicious AI coding extension that attempts to open a reverse SSH tunnel from a developer workstation is a full-environment compromise in one package. Audit every extension and plugin in your development environments, prefer verified publishers, monitor for reverse-tunnel and unusual outbound-connection processes on developer machines, and treat build and dev infrastructure with the same hardening standard as production.
Prepare for leak-site extortion specifically. Crews like The Gentlemen assume data exfiltration precedes encryption — their leverage is the leak site, not the encrypted files. Segment data stores so a single intrusion cannot reach everything, maintain tested offline backups, and run at least one tabletop exercise a year on the question: what do we do in the first 72 hours if our data appears on a leak site?
The Bottom Line
A ransomware crew nearly tripled its output in a single week — during the same week one of its own affiliates was publicly exposed, along with 50 terabytes of his infrastructure. The threat did not pause for embarrassment; it accelerated. The crews doing this are running exploitation-first attack chains that are visible to good monitoring long before the ransom note appears, and the entry points they rely on — unpatched edge services, injection flaws, unverified remote-access approvals, and unscoped credentials — are all fixable this quarter.
To see the correlations yourself in BlackBeam, our Internet Intelligence Platform, visit https://www.defendedge.com/blackbeam/. BlackBeam’s actor-level surge tracking, IOC correlation, and wildcard-domain monitoring — the kind of platform data behind every number in this post — is powered by iDNA, our threat intelligence engine. And if your organization wants a US-based Security Operations Center watching this landscape for you around the clock, contact DefendEdge.
Leave a Reply