Threat reportRansomwareTL-2026-4340
Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share
Ransomware Surge in Q3 2026 (TL-2026-4340), also tracked as Q3 2026 ransomware surge, is a high-severity ransomware operation, first published 2026-10-24. It is attributed to The Gentlemen with medium confidence, affects Fortinet FortiOS / FortiProxy, references 5 CVEs (CVE-2024-55591, CVE-2025-32433, CVE-2025-33073), maps to 14 MITRE ATT&CK techniques (T1021.002, T1021.004, T1046), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 14MITRE ATT&CK
- Actors
- 1The Gentlemen
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4340
- Threat ID
- TL-2026-4340
- Also known as
- Q3 2026 ransomware surge
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, technology, health, critical infrastructure
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Ransomware Surge in Q3 2026
Malware and tooling: AgendaCrypt, Akira, BlackCat - S1068, Clop Leaks, Custom Go-based backdoor, Deadlock, GentleKiller, LockBit, RansomHub - S1212, SystemBC - S9001, inc ransom, krybit
How Ransomware Surge in Q3 2026 works
2,894 ransomware attacks were recorded July-September 2026, up 50% year over year and 8.6% over April-June 2026. The Gentlemen (383 attacks) edged past Qilin (363); its founder reportedly previously ran one of Qilin's top affiliate crews and now offers affiliates a 90% payout.
Nord Security data reported by Infosecurity Magazine on 2026-10-21 counted 2,894 ransomware attacks between July and September 2026, a 50% increase over the same period of 2025 and an 8.6% increase over April-June 2026. The Gentlemen was the most prolific group with 383 attacks, ahead of Qilin (363) and Inc Ransom (110). Krybit, Akira, Deadlock and Clop Leaks each recorded roughly 100 attacks. The report notes that groups have traded places as the most common perpetrator throughout 2026. The reported initial access methods are compromised passwords, lack of multi-factor authentication and unpatched vulnerabilities, with a growing share of operations relying on data theft and extortion without encryption ("stealing data is faster and simpler, so one group can hit many victims at once with far less effort").
The Gentlemen is a ransomware-as-a-service operation first seen in July 2025 (Palo Alto Unit 42). Its operators likely operated earlier as the "ArmCorp" affiliate of the Qilin RaaS, and the Infosecurity report says the founder was a top Qilin affiliate who left after a public dispute over an unpaid cut. The group advertises a 90% affiliate payout against the typical 70-80%. Unit 42 counted 580 claimed victims in 77 countries through 2026-07-07, with manufacturing the largest sector (103 victims); Check Point Research, which gained access to a live C2 server, reported 1,570+ likely corporate victims, a larger number than publicly claimed, with the USA, UK and Germany the top countries. In May 2026 an operational-security failure exposed the group's internal Rocket.Chat platform (23 chat rooms, thousands of messages, hundreds of screenshots).
Observed tradecraft (Unit 42, Check Point, ReliaQuest): initial access through edge devices (firewalls, VPNs, remote access gateways), RDP/remote access, brute force, leaked or stolen credentials and initial access brokers; rapid movement to the domain controller; Advanced IP Scanner for discovery; SMB and SSH (ESXi) lateral movement; domain-wide encryption pushed via Group Policy within hours; lockers written in C and Go for Windows, Linux and ESXi; EDR tampering with the GentleKiller framework and vulnerable driver loading (ThrottleStop.sys, CVE-2025-7771); SystemBC and a custom Go backdoor for command and control; wevtutil log clearing; vssadmin/wmic shadow copy deletion; scheduled tasks with names containing 'gentlemen'. Unit 42 associates the group with CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182 and CVE-2025-7771. The source articles provide no file hashes, IP addresses or domains, so none are recorded.
MITRE ATT&CK techniques used in TL-2026-4340
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 Remote Services: SSH
Discovery
T1046 Network Service Discovery
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
Credential Access
defense-impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Impact
Affected products and versions in Ransomware Surge in Q3 2026
- Fortinet — FortiOS / FortiProxy
Vulnerable versions: CVE-2024-55591 affected builds
Fixed in: See vendor advisory - Microsoft — Windows SMB Client
Vulnerable versions: CVE-2025-33073 affected builds
Fixed in: See vendor advisory - Erlang/OTP — SSH server
Vulnerable versions: CVE-2025-32433 affected releases
Fixed in: See vendor advisory - VMware — ESXi
Vulnerable versions: Targeted by Linux/ESXi lockers
Remediation for Ransomware Surge in Q3 2026
Patches
- Patch edge devices promptly, including Fortinet FortiOS/FortiProxy CVE-2024-55591
- Patch CVE-2025-32433 (Erlang/OTP SSH), CVE-2025-33073 (Windows SMB client) and CVE-2025-55182 (React2Shell)
Immediate actions
- Enforce MFA on all VPN, firewall, RDP and remote access gateways and reset potentially compromised credentials
- Restrict RDP and other remote access exposed to the internet
- Enable Microsoft's vulnerable driver block list to stop loading of drivers such as ThrottleStop.sys
- Alert on shadow copy deletion, event log clearing and scheduled tasks containing 'gentlemen'
Workarounds
- Remove or block known vulnerable drivers (CVE-2025-7771 ThrottleStop.sys) via driver block rules
- Disable internet exposure of management interfaces until patched
Longer-term hardening
- Deploy EDR with tamper protection and behavioral detection of EDR-killer activity
- Monitor and restrict mass GPO changes and SMB/SSH lateral movement; segment ESXi management networks
- Maintain offline, tested backups and monitor for large outbound data transfers (extortion without encryption)
- Harden identity against credential theft, vishing and AiTM attacks
CVEs associated with Ransomware Surge in Q3 2026
CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, CVE-2025-7771
Timeline of Ransomware Surge in Q3 2026
- The Gentlemen RaaS first seen (July 2025, exact day not stated by Unit 42); operators likely active earlier as the 'ArmCorp' Qilin affiliate.
- Data leak site announced and the group's internal Rocket.Chat platform exposed (23 chat rooms, thousands of messages) in May 2026; exact days not stated in sources.
- Unit 42 counts 580 claimed victims in 77 countries since inception through this date; June 2026 peak of 117 victims.
- ReliaQuest reports The Gentlemen (300 attacks) overtook Qilin (289) in March-May 2026 across 1,368 victim claims by 11 groups.
- Infosecurity Magazine publishes 'The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat'.
- Barracuda publishes analysis of The Gentlemen as one of the fastest-growing extortion operations.
- End of July-September 2026 period: 2,894 attacks recorded; The Gentlemen 383, Qilin 363, Inc Ransom 110.
- Nord Security Q3 data reported: attacks up 50% year over year and 8.6% over April-June 2026; The Gentlemen offers a 90% affiliate payout.
Sources cited for Ransomware Surge in Q3 2026
- Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
- The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat
- The Gentlemen Ransomware (Unit 42)
- The Gentlemen: A New Ransomware Threat Climbing the Charts Fast (Check Point Research)
- 'The Gentlemen' Rapidly Rises to Ransomware Prominence (Dark Reading)
- Tables Turn on 'The Gentlemen' RaaS Gang With Data Leak (Dark Reading)
- The Gentlemen ransomware: Inside one of the fastest-growing extortion operations (Barracuda)
- Who Are The Gentlemen? (Fortra)
- Threat Actor Profile: The Gentlemen (Gurucul)
Detection coverage for TL-2026-4340
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4340 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.