From Conti to The Gentlemen: tooling evolved, gaps didn't. by Lucie Cardiet

**Executive summary:** Analysis of four operator-side leaks (Conti, Black Basta, LockBit, The Gentlemen) from 2022–2026 shows ransomware operators have decentralized and reused personnel/infrastructure across rebrands while their core intrusion and exfiltration methods remain unchanged: edge appliance authentication failures, browser-stored credential theft, NTDS.dit extraction from VSS backups, hypervisor-level encryption, and rclone→MEGA exfiltration; the report documents exploited CVEs, tooling (e.g., LummaC2, Phemedrone, rclone), and prescribes five remediation priorities to close recurring detection gaps.