Infostealers, AI, and a 90% Affiliate Cut Fuel The Gentlemen group’s Rise

**Executive summary:** The Gentlemen is a ransomware operation (first observed Sept 2025) that leveraged credentials and session cookies stolen by commodity infostealers, AI-assisted tooling, and a 90% affiliate revenue split to compromise and extort 483 victims across 66 countries by June 2026; leaked chat logs reveal exploitation of internet-facing vulnerabilities (including CVE-2024-55591), mailbox abuse, and AI models used for coding and analyzing stolen data, while recommended defenses emphasize urgent patching, session revocation, stronger MFA/passkeys, AD hardening, segmentation, and offline backups.