No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

Unit 42 publishes a broad set of July–June 2026 research and threat briefs covering active exploitation, supply‑chain and cloud risks, and emergent malware trends. Highlights include: the rapid growth of The Gentlemen ransomware via an affiliate model; a Vidar stealer campaign that combines loader‑as‑a‑service, code‑signing abuse, Go‑compiled loaders and DLL sideloading (fake MpClient.dll) often paired with XMRig mining; active exploitation guidance for PAN‑OS (CVE‑2026‑0257); a Vertex AI Python SDK vulnerability enabling RCE via bucket squatting; and research into universal bucket hijacking (