INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Exploits Vulnerability in Microsoft Office to Infect

| 2026-10-21 06:20 CRITICAL MEDIUM RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
The Gentlemen, a Russian-speaking ransomware-as-a-service group, emerged in mid-2025 after operating as an affiliate of LockBit and Qilin. Organizations in the United States and Europe are most frequently targeted, particularly in manufacturing, technology, healthcare, professional services, and retail sectors. The attack works by targeting Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data via PsExec. A May 2026 infrastructure breach exposed internal communications, affiliate information, and connections to the Qilin ecosystem, affecting over 800 victims across multiple regions and sectors.
Technical Mitigations AI-generated
• Patch vulnerable drivers to prevent termination of security processes. • Use a secure encryption algorithm, such as ChaCha20 with multiple speed modes, instead of Chacha20 used by The Gentlemen ransomware. • Implement network segmentation and monitoring to detect lateral movement via PsExec.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 20 IoCs Create Free Account
9ef41c••••••••••••••••••••••••••••••••••
698354••••••••••••••••••••••••••••••••••
a1894e••••••••••••••••••••••••••••••••••
9887bc••••••••••••••••••••••••••••••••••
363a43••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
3c2466••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
403187••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
228fc8••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
6440df••••••••••••••••••••••••••
f3c6ca••••••••••••••••••••••••••
598b22••••••••••••••••••••••••••
698ce5••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
The GentlemenThe Gentlemen QilinQilin
Target & Sectors
EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA retailretail manufacturingmanufacturing healthhealth technologytechnology
Incident Timeline
‎mid-2025
The Gentlemen, a Russian-speaking ransomware-as-a-service group, emerged in mid-2025.
target_region Russian Federation
The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin.
tactic Ransomware
The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin.
threat_actor The Gentlemen
The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin.
organisation LockBit
The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin.
malware Qilin
The Gentlemen is a Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin.
‎May 2026
Threat actors exploited vulnerabilities in May 2026 to breach the infrastructure of organizations, exposing internal communications and affiliate information linked to Qilin.
malware Qilin
A May 2026 infrastructure breach exposed internal communications, affiliate information, and connections to the Qilin ecosystem.
‎2026/10/21
The Gentlemen ransomware-as-a-service operation claimed over 800 victims across multiple regions and sectors, targeting various systems including Windows, Linux, NAS, and BSD.
threat_actor The Gentlemen
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation.
infrastructure Windows
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
infrastructure Linux
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
organisation NAS
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
organisation BSD
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
organisation PsExec
Written in Go, the ransomware employs ChaCha20 encryption with multiple speed modes, terminates security processes using vulnerable drivers, and spreads laterally through networks via PsExec.
victims 800 victims
The group offers affiliates up to 90% of ransom revenue and has claimed over 800 victims across multiple regions and sectors.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
Metrics
infrastructure
‎Linux
Affected Product
The ransomware targets Windows, Linux, NAS, and BSD systems using a double-extortion model that encrypts files and exfiltrates data.
Metrics
victims
800
Victims
The group offers affiliates up to 90% of ransom revenue and has claimed over 800 victims across multiple regions and sectors.
Intelligence Sources
AlienVault OTX 2026-10-21