Ransomware Group Claims 478 Victims, Spreads Like Worm

The Gentlemen ransomware operation, active since March 2025, has claimed 478 victims. The group, tracked as Phantom Mantis by PRODAFT, is led by Russian-speaking threat actor LARVA-368, identified as Alexander Andreevich Yapaev. The group transitioned from a RaaS affiliate to an independent program in July 2025 and relies heavily on AI for development and post-exploitation.