Pietro Melillo : 9 September 2025 22:04
In Q3 2025, a new ransomware group, identified as The Gentlemen, was observed launching its own Data Leak Site (DLS) on the Tor network.
The group’s infrastructure and operational methods indicate a medium-high level of organization, with a particular focus on image management and operational security. The Gentlemen’s DLS is accessible via a .onion address and looks like this:
The absence of superfluous features and the choice of decentralized protocols reduce the attack surface against their infrastructure.
The victims observed belong to sectors with high strategic value:
The approach suggests a strategy aimed at entities with low tolerance for disruption and strong reputational exposure.
The debut of The Gentlemen confirms that the ransomware landscape is constantly evolving. The attention to detail, the construction of a clean and functional DLS, and the selection of targets in the most profitable industrial sectors suggest that this group is not an improvised initiative, but the result of an organization with consolidated resources and expertise.
For companies, the lesson is clear: strengthening network defenses and incident response processes is now essential, especially in those sectors that represent a primary target for next-generation malicious actors.
Pietro Melillo