The Gentlemen: LLMs Cut Ransomware Development…

CERT-AGID reports the ransomware group The Gentlemen uses LLMs to build platforms in three days, personalize extortion, and replicate tactics from Black Basta leaks.

CERT-AGID has published an analysis of the ransomware group The Gentlemen documenting the systemic integration of large language models into criminal operations. The dossier describes how a single operator developed a negotiation platform in three days using LLM-based coding assistants. The finding marks a concrete turning point: generative AI ceases to be a defensive tool and becomes a measurable offensive multiplier in the malware lifecycle.

Key Takeaways

The negotiation platform was developed in three days by a single operator using LLM coding assistants, versus traditional timelines of weeks.
Language models power the personalization of extortion communications, extracting OSINT data to identify specific victim weak points.
The group used internal manuals stolen from other cybercriminal organizations, including Black Basta, to fine-tune their own LLMs.
The Go variant of the ransomware includes a --spread parameter that converts the payload into a self-replicating worm for automated network-wide encryption.
The RaaS model offers affiliates 90% of the ransom, with roughly 500 global victims claimed in under a year.

One Operator, Three Days of Development

According to CERT-AGID's analysis, "the negotiation platform was entirely developed in just three days by the operator." The documented mechanism uses LLM-based coding assistants to accelerate construction of the victim-contact infrastructure. The source does not specify which language models were employed nor provide technical details on the platform architecture.

The time metric is central: compression from weeks to three days alters the cost-benefit ratio for criminal operators. This pattern indicates a substantial reduction in the barrier to entry in the ransomware-as-a-service market, where The Gentlemen operates by offering affiliates 90% of the ransom. The economic model, also flagged by FortiGuard, shifts operational risk to the affiliate while the core group retains the technological margin.

OSINT and Extortion Personalization

CERT-AGID documents a second LLM application in the victim engagement phase. "Data extracted by the AI feeds prompts to structure and personalize blackmail emails and phone contact attempts, autonomously identifying victim weak points." The mechanism combines automated information gathering with contextual generation of pressure messages.

Personalization is not limited to text: the source explicitly mentions phone contact attempts, indicating an extension of the attack from digital to voice channels. This element suggests integration between OSINT data pipelines and multi-channel communication.

The Secondary Market for Tactics: Fine-Tuning on Rival Leaks

The third documented vector is the most relevant for competitive dynamics among criminal groups. According to CERT-AGID, The Gentlemen "used confidential data and internal manuals stolen from other cybercriminal organizations (such as Black Basta) to fine-tune or provide context for their own LLM models." The mechanism transforms internal data leaks from rival groups into primary material for machine learning, creating an accelerated circuit for tactic reproduction.

The citation of Black Basta as a specific example is the only attribution of competitor intelligence source in the dossier. The brief does not clarify how these materials were acquired nor whether fine-tuning was performed on open-source models or commercial services.

Worm-Like Propagation and Five Payload Variants

The ransomware's technical component comprises five variants for Windows, Linux, and ESXi. The Go-written version includes a --spread parameter that, according to the source, "converts the payload into a self-replicating worm, capable of automating encryption of the entire corporate network by exploiting lateral movement." The mechanism requires no manual interaction for internal propagation, reducing the victim's exposure time between initial access and mass encryption.

The documented initial access vector is twofold: purchase of credentials via infostealers, or scanning of known unpatched vulnerabilities on Cisco and Fortinet appliances when valid credentials are unavailable.

"The adoption of artificial intelligence is no longer merely theoretical, but acts as a true effectiveness multiplier for the gang's activities" — CERT-AGID

What to Do Now

CERT-AGID indicates three priority actions for organizations exposed to The Gentlemen's documented tactics.

First: monitor the CERT-AGID IoC feed, accrediting via the dedicated form to receive updated compromise indicators. The source explicitly cites this channel as an available defensive intelligence tool.

Second: check for compromised credentials in your perimeter, given that infostealer purchases represent the primary documented initial access vector. The 90% affiliate payout in the RaaS model incentivizes rapid scaling of valid accesses.

Third: patch known vulnerabilities on Cisco and Fortinet appliances, identified in the brief as targets for automated scanning when credentials are unavailable. The Go variant with the --spread parameter amplifies the damage of every single initial access into full network encryption.

Discrepancies and Dossier Limits

The dossier presents numbers in tension. CERT-AGID reports roughly 500 global victims in under a year; FortiGuard documents over 200 victims in more than 50 countries as of early 2026. The two sources are not temporally or methodologically overlapping: the CERT-AGID count refers to group claims, while FortiGuard's refers to independently verified cases.

The RaaS model itself carries uncertainties. FortiGuard characterizes the service architecture as "speculated" and reports "mixed feedback" on its actual operability, with an alternative hypothesis of a tight-knit team. The 90% affiliate claim, present in both sources, is insufficient to verify the real organizational structure.

The May 2026 data leak, cited by CERT-AGID as the event that pushed the group to migrate to decentralized platforms, is not corroborated by independent sources in the dossier.

The lack of independent corroboration on LLM use constitutes the most relevant limit: no cited private security vendor separately verifies CERT-AGID's claims. Technical proof remains bound to the Italian institutional analysis.

The Gentlemen case nonetheless indicates a trajectory: generative AI as an automation layer inserted at specific points in the ransomware kill chain, not as a replacement for the human operator but as a time compressor and scale amplifier. The critical variable for defense remains the speed of remediation for compromised credentials and patching of known vulnerabilities.

Information is based on the cited source and current as of publication.

Sources

Sources and references