Worm-Like Ransomware Raises the Containment Stakes
The usual ransomware model breaks down when the malware can move on its own. One infected host can become many without a human operator pushing each step, so segmentation and endpoint isolation have less time to contain the blast radius.
PRODAFT says The Gentlemen shifted in July 2025 from an affiliate role to an independent RaaS operation, with AI used for development and maintenance and a worm-like spread capability. The group, tracked as Phantom Mantis, is tied to 478 claimed victims since March 2025.
That makes this more than a gang rebrand. It points to faster internal spread and a shorter window to stop an outbreak once one system is compromised.