A new ransomware brand can become operationally significant in months, not years. The Gentlemen’s public leak listings and affiliate recruitment show a RaaS model that can generate parallel intrusions at speed, which is the real risk for defenders watching young crews mature.
Check Point says The Gentlemen, which emerged around mid-2025, had about 332 published victims in just the first five months of 2026. That put it among the most productive public RaaS operations in that period, and the group’s leaked internal data and chats point to an organized affiliate ecosystem rather than a loose one-off crew.
The forward risk is pace, not novelty. A fast-scaling affiliate program can keep adding victims before the brand looks established, so incident volume and unpredictability can outgrow common assumptions about how long a new ransomware operation takes to matter.