Workstation in The Gentlemen ransomware intrusion identified as Lazarus infrastructure (in "The Gentleman Ransomware | Defense Evasion TTPs Uncovered")

Date (as written): 2026-05-21T07:00:00.000Z
Year: 2026
Actors (as written): Lazarus (per Red Asgard)
Actor pages: Lazarus

Source entries (1)

Huntress blog

Workstation in The Gentlemen ransomware intrusion identified as Lazarus infrastructure (in "The Gentleman Ransomware | Defense Evasion TTPs Uncovered") · 2026-05-21T07:00:00.000Z

FalconFeeds as being associated with Qilin ransomware, and has been identified by Red Asgard as being part of Lazarus infrastructure.

https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps

Suggest a correction on GitHub