TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Infosecurity Magazine

Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation

2026-03-19 · Read original ↗

ATT&CK techniques detected

10 predictions
T1486Data Encrypted for Impact
98%
“these ecosystems allow developers to scale attacks while outsourcing much of the operational risk. read more on ransomware - as - a - service threats : researchers warn of new " vect " raas variant group - ib noted that the evolution of groups like the gentlemen reflects a broade…”
T1486Data Encrypted for Impact
97%
“ransomware affiliate exposes details of ' the gentlemen ' operation a ransomware affiliate known as ' hastalamuerte ' has revealed operational details about a group called the gentlemen, shedding light on its tactics, techniques and internal disputes. new research by group - ib, …”
T1585.002Email Accounts
85%
“ransomware affiliate exposes details of ' the gentlemen ' operation a ransomware affiliate known as ' hastalamuerte ' has revealed operational details about a group called the gentlemen, shedding light on its tactics, techniques and internal disputes. new research by group - ib, …”
T1078Valid Accounts
83%
“or brute forcing remains a primary initial access method. once inside, affiliates deploy automated lateral movement, credential harvesting, backup disruption and domain - wide encryption designed to maximize impact and reduce time to ransom. among the techniques observed by group…”
T1585.002Email Accounts
75%
“these ecosystems allow developers to scale attacks while outsourcing much of the operational risk. read more on ransomware - as - a - service threats : researchers warn of new " vect " raas variant group - ib noted that the evolution of groups like the gentlemen reflects a broade…”
T1657Financial Theft
73%
“ransomware affiliate exposes details of ' the gentlemen ' operation a ransomware affiliate known as ' hastalamuerte ' has revealed operational details about a group called the gentlemen, shedding light on its tactics, techniques and internal disputes. new research by group - ib, …”
T1003OS Credential Dumping
48%
“or brute forcing remains a primary initial access method. once inside, affiliates deploy automated lateral movement, credential harvesting, backup disruption and domain - wide encryption designed to maximize impact and reduce time to ransom. among the techniques observed by group…”
T1080Taint Shared Content
47%
“these ecosystems allow developers to scale attacks while outsourcing much of the operational risk. read more on ransomware - as - a - service threats : researchers warn of new " vect " raas variant group - ib noted that the evolution of groups like the gentlemen reflects a broade…”
T1588.001Malware
34%
“ransomware affiliate exposes details of ' the gentlemen ' operation a ransomware affiliate known as ' hastalamuerte ' has revealed operational details about a group called the gentlemen, shedding light on its tactics, techniques and internal disputes. new research by group - ib, …”
T1486Data Encrypted for Impact
30%
“or brute forcing remains a primary initial access method. once inside, affiliates deploy automated lateral movement, credential harvesting, backup disruption and domain - wide encryption designed to maximize impact and reduce time to ransom. among the techniques observed by group…”

Summary

Hastalamuerte leaks The Gentlemen RaaS ops: FortiGate exploits, BYOVD evasion, Qilin split tactics