Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Thus Spoke…The Gentlemen Key Points Introduction The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. Its operators advertise the service across multiple underground forums, promoting their ransomware platform and inviting penetration testers and other technically skilled actors to join as affiliates. In 2026, based on victims listed on the data leak site (DLS), […] The post Thus Spoke…The Gentlemen appeared fir…

https://research.checkpoint.com/2026/thus-spoke-the-gentlemen

sha256:4beae55dfb643f240ac00bb868c1516cab6172897c1d3e473564b6827bbdc28b

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve3
md530
url7
ipv40
ipv60
sha10
domain7
sha25633
malware_token1
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	ntds.dit	Open →
domain	github.com	Open →
cve	CVE-2024-55591	Open →
domain	readme-gentlemen.txt	Open →
domain	gentlemen.bmp	Open →
sha256	025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a	Open →
sha256

Malware families

Allowlist token matches only.

LockBitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports