TheGentlemen ransomware lists RAK Construction
Ransomware.live tracked a leak-site listing for RAK Construction attributed to a group calling itself TheGentlemen.
This entry is a minimal victim-listing record from the ransomware.live leak-site tracker, showing that a construction company referred to as RAK Construction was posted as a victim by a ransomware operation identifying itself as 'TheGentlemen'. The source page contains no technical details, no ransom note content, no exfiltrated data samples, and no indicators of compromise — only DNS record placeholders and a standard legal disclaimer noting that ransomware.live does not host or access stolen data itself.
Given the lack of substantive detail, this should be treated as a low-confidence, low-context tracking entry rather than a full incident report. Analysts should monitor for follow-up reporting or direct confirmation from RAK Construction or additional disclosure from the TheGentlemen group before drawing further conclusions about tactics, scope, or impact.
Mentioned in this report
Source reporting: https://www.ransomware.live/id/UkFLIENvbnN0cnVjdGlvbkB0aGVnZW50bGVtZW4=
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free