8,200 Chat Logs Leaked as “The Gentlemen” Ransomware Syndicate is Exposed and Decrypted

The Gentlemen collective, recently heralded as one of the most prolific ransomware enterprises of 2026, has itself fallen victim to a profound data exfiltration. Internal correspondences have been thrust into the public domain, illuminating the mundane yet predatory operations of these extortionists: their selection of targets, the orchestration of assaults, infrastructure management, and their calculated maneuvers to evade defensive systems.

Initial reports of the breach surfaced on the Breached forum on May 4. An anonymous actor initially listed the purloined data for a ransom of $10,000 in Bitcoin before subsequently providing a MediaFire hyperlink, rendering the archive accessible to the public free of charge.

According to Milivoje Raič, Head of Threat Intelligence at DynaRisk, the leak encompasses approximately 8,200 lines of internal chat logs, imagery of compromised systems, and temporal markers that largely align with a Moscow-based professional schedule. The materials reveal granular discussions regarding VPN access, OpenConnect, command-and-control apparatuses, payload delivery, the deactivation of EDR solutions, and the escalation of privileges to Domain Administrator within Active Directory.

The dialogues suggest that incursions frequently originated from stolen credentials for Fortinet networking hardware. To maintain remote dominion over compromised environments, members of The Gentlemen routinely utilized the open-source ZeroPulse repository on GitHub. Prior to deploying encryption, the adversaries meticulously surveyed the network for virtualization servers, backup repositories, NAS storage, and Exchange servers, aiming to amplify the psychological pressure on the victim and sabotage recovery efforts.

The exfiltrated data also contains Bitcoin addresses utilized for internal remuneration and the acquisition of hardware. Furthermore, the logs indicate that The Gentlemen compromised a firm bound by non-disclosure agreements with Sony and Barclays, threatening the public exposure of sensitive documents absent a settlement.

A simultaneous blow was dealt to the syndicate by Bedrock Safeguard, which, on May 2, unveiled a public decryptor that bypasses the need for payment. The firm did not break the underlying cryptographic algorithm but instead exploited a structural vulnerability in its implementation: ephemeral cryptographic keys were inadvertently preserved within the process memory. In empirical testing, specialists successfully restored 35 out of 35 files, with the key retrieval process concluding in under a second.

The Gentlemen emerged as a Ransomware-as-a-Service (RaaS) venture in mid-2025. By April 2026, their leak portal featured over 340 organizations that had refused to comply with their demands. According to ZeroFox, the syndicate promised affiliates up to 90% of the ransom, increasing that share to 97% for extortion efforts that eschewed encryption in favor of pure data theft. Following the release of the decryptor, the extortionists rapidly updated their malware, demonstrating the remarkable agility with which such criminal operations adapt to the countermeasures of the security community.