A batch day is a day when a ransomware group’s leak site lists many victims in one sitting. That is our reading of the term, not a standard definition.
On 26 October 2026, Brandefense’s THANOS dark-web monitoring saw what looks like one: 38 different victim entries credited to The Gentlemen ransomware group. One automatic Telegram channel relayed them between 13:05 and 18:00 UTC, in under five hours. These are the group’s own claims, and Brandefense has not verified them.
Defenders should care because each entry is a claimed victim, and vendor reports show how the group gets in and spreads. That path, and the fixes that break it, follow below.
What Did We See on 26 October?
We searched THANOS for “the gentlemen” from 20 to 27 October. Many hits use the word in other ways, so we kept only automatic ransomware alerts that name the group as the actor. On 26 October that gave 38 alerts, all from one channel, each with a different victim name. Every alert listed the country as “not available”.
The busiest hour was 15:00 UTC, with 14 alerts. Nearly all of them (36 of 38) landed between 14:00 and 16:59. The times are when THANOS collected each relay, not when the group put the entry on its leak site, so the group’s own timing may differ.
The card below recreates the format of one such alert. We removed the victim name and the channel name, and we do not link to the channel.
A second Telegram channel that publishes cyber alerts relayed three of the same 38 claims, one on 26 October and two on 27 October. They concern a transport business, a hospitality business and a wholesale and retail business, and that channel marks all three as pending verification.
Is a Batch Day Normal for This Group?
Yes, by its own record. According to ransomware.live, a public tracker, The Gentlemen has had 8 days with 30 or more new listings since its first batch on 9 September 2025. The largest was 41 listings on 1 July 2026.
The eight days were 9 September 2025 (32 listings), 6 May 2026 (40) and 1 July 2026 (41). The others were 23 July (31), 31 July (32), 15 September (30), 9 October (37) and 16 October (33).
Our 38 comes from THANOS, a different source, so it is not in that list. Set beside the tracker’s 37 on 9 October and 33 on 16 October, it looks like the third large batch in under three weeks. It is also close to the group’s record of 41.
The monthly totals point the same way. The tracker lists 177 listings for July 2026, its busiest month, then 113 for August and 105 for September. October stands at 93 through the 24th. In total the tracker holds 1,006 listings for the group.
How Does an Intrusion Run, From the First Device to Encryption?
The diagram uses only what Unit 42, Sophos, Trend Micro and Check Point say. The order of the later steps follows one incident in Check Point’s report, and the entry point could not be confirmed in two of the incident reports.
- Firewall or VPN gatewayEdgeflaw or brute force
- Scan and remote admin toolsInside the networkEDR killer ends defenses
- Group Policy objectInside the networktask runs as SYSTEM
- Locker runs on each hostEvery hostshadow copy delete
- Network encryptedEvery host
The vendors agree on the shape of an attack, though not on every detail.
- Entry through the edge. Unit 42 names exploited firewalls and VPNs and brute force. Sophos says affiliates kept a list of Fortinet FortiGate devices open to CVE-2024-55591, plus brute-forced VPN credentials. Check Point’s Q1 report mentions a cache of about 14,700 pre-exploited FortiGate devices. Trend Micro and Check Point’s incident report could not confirm the entry point in their own cases.
- Switching off defenses. Unit 42 describes an EDR killer framework called GentleKiller. Sophos says the group uses vulnerable drivers to end EDR processes. Check Point’s incident report adds that the encryptor turns off Defender real-time monitoring, deletes shadow copies and clears event logs before it starts.
- Spreading by Group Policy. Sophos and Check Point both describe distribution through Group Policy objects. Check Point’s incident report shows a mode that creates a policy with a scheduled task running as SYSTEM, ending in a near-simultaneous encryption event.
- Speed. Check Point’s April blog says the group can encrypt entire networks within hours.
What Do Security Vendors Say About The Gentlemen?
We read reports from four vendors. They were published on different days, so their numbers differ.
- Palo Alto Networks’ Unit 42 (10 July 2026) describes a ransomware-as-a-service program active since at least July 2025. It cites an outside count of 580 claimed victims in 77 countries, 103 of them in manufacturing, and says the group offers affiliates a 90 percent payout. Citing public reporting, it says the operators were likely an affiliate of Qilin ransomware months earlier.
- Check Point Research (20 April 2026) counted over 320 victims since mid-2025, 240 of them in 2026. It ranked the group second by victim count for the year so far. Its Q1 2026 report places it third on the global list.
- Sophos tracks the operator as GOLD SHERWOOD. It says the first victims appeared on a leak site in September 2025, and that the program uses double extortion and a 90/10 ransom split.
- Trend Micro (9 September 2025) published an early analysis and called the group previously undocumented. It investigated an August 2025 campaign across at least 17 countries, with manufacturing hit hardest.
What Should Defenders Do First?
These steps come from the same vendor pages. Start at the top.
- Patch edge devices first, starting with CVE-2024-55591 on FortiOS and FortiProxy. Unit 42 also lists CVE-2025-32433, CVE-2025-33073, CVE-2025-55182 and CVE-2025-7771.
- Use phishing-resistant MFA (Unit 42) and enforce MFA on every administrative interface. Close direct RDP exposure (Trend Micro).
- Switch on EDR tamper protection (Unit 42, Trend Micro).
- Alert on shadow-copy deletion through vssadmin and wmic, and on scheduled tasks with names matching “gentlemen*” (Unit 42).
- In our reading, Check Point’s description of the Group Policy route is a good reason to alert on new policy objects that run scheduled tasks.
- Enforce SMB signing and turn off SMBv1. On ESXi, keep SSH off and put management on an isolated VLAN (Unit 42).
- Check that backups are isolated, meaning offline and immutable (Check Point).
How Did We Count, and What Do the Numbers Not Tell You?
THANOS is our dark web monitoring. We searched it from 20 to 27 October 2026 and counted distinct victim names in one automatic relay channel on 26 October. We read the entries in the alerts, not the leak site itself.
- Each entry is a claim by the group. A name on a leak site does not prove a breach, and we have not checked any of the 38.
- Hours are collection times in UTC, not leak-site posting times.
- We counted entries we saw. Other channels may relay more, or the same ones.
- The relay gave no country, so we cannot say where the victims are.
- Tracker counts use ransomware.live’s own discovered date, and trackers and vendors differ in what they count.
Last checked: 27 October 2026, 11:00 UTC.