RST TI Report Digest: 18 May 2026

**Thus Spoke…The Gentlemen** — The Check Point report outlines 'The Gentlemen', a 2026 ransomware-as-a-service operation with ~332 public victims; a May 4, 2026 leak of its 'Rocket' backend exposed affiliate structure, an admin identified as zeta88/hastalamuerte, initial access vectors (Fortinet/Cisco device exploitation, NTLM relay, OWA/M365 credential theft), TTPs (lateral movement, security-tool disabling, CVE monitoring), discussions of ransom laundering/competition, and numerous IoCs including many file hashes.