The Gentlemen ransomware attacks in India
The Gentlemen (also tracked as Storm-2697) has posted 36 Indian organisations on its leak site since Sep 2025, 33 of them in the past 12 months, making it the most active group in India over that period. The sector it hits most often in India is manufacturing.
Indian victims by month
Red bars are the past 12 months.
Sectors hit in India, all time
Indian victims by year
Where in India, past 12 months
Victims whose head office state could be confirmed, in states with at least 3 located victims. Smaller states are left out so no organisation can be picked out.
Where it comes from
Russian-speaking cybercrime ecosystem (evidence: strong)
Main operator is a Russian-speaking former Qilin affiliate; recruits on the RAMP forum; leaked internal chats are in Russian; bans attacks on Russia and the CIS.
Sources: Sophos, Barracuda, Aug 2026. How evidence levels are judged: method.
Other gangs active in India
Leak-site counts from ransomware.live’s public data for victims with country India, as of 16 Oct 2026. A post is a claim made by a criminal group, not a confirmed breach, and the real number of attacks is higher. Victims are never named on this site. See the method.