Who Runs the Ransomware Group ‘The Gentlemen?’
2026-06-17T19:23:26Z•f2da6fd1a5103a2092f27eb6dfcc921d76bf062a1bf7c34abca713889810affc
account takeoveranti-ddos abuseaws govcloudbotnetcanvas breachcisacongressional inquirycredential leakcritical vulnerabilitiesdata extortionddosdort arresteducation sectorinfrastructure seizurekimwolfmeta ai support botmicrosoft patch tuesdaynetherlandspatchingpublic exploit coderansomwarerussia-linked activitysocial engineeringthe gentlemenvulnerability management
What happened
KrebsOnSecurity aggregated multiple high-impact cyber incidents: investigative clues point to a real-world identity for the administrator of the ransomware group “The Gentlemen”; Microsoft shipped a record Patch Tuesday (nearly 200 fixes, ~3 dozen rated critical and at least three with public exploit code); attackers abused Meta’s AI support assistant to hijack Instagram accounts; a CISA contractor publicly leaked AWS GovCloud keys and internal secrets on GitHub, triggering congressional inquiries; Dutch authorities seized ~800 servers and arrested two operators for facilitating Russian cyber-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- f2da6fd1a5103a2092f27eb6dfcc921d76bf062a1bf7c34abca713889810affc
- Enrichment time
- 2026-06-17T19:23:26Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.