The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm

**The Gentlemen (aka Phantom Mantis / ArmCorp)** is a financially motivated ransomware/RaaS operation led by a Russian-speaking actor known as LARVA-368 that evolved from an affiliate role into an independent extortion partnership, leveraging AI, custom tooling, cross-platform encryptors (Windows/Linux/ESXi/LVM), and double-extortion methods; it has claimed hundreds of victims, employs aggressive affiliate economics and BYOVD techniques, exploits known CVEs and edge devices, and recently had an operator toolkit and internal Rocket.Chat messages leaked, revealing operational TTPs and tooling.