TheGentlemen ransomware claims Telcom Communications
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware group TheGentlemen lists Petroleum Telcom Communications, a small California radio/fiber integrator, as a new victim.
Ransomware.live has indexed a new victim posting attributed to the ransomware group known as "TheGentlemen," naming Petroleum Telcom, Inc. (dba Telcom Communications, ptelcom.com) as a target. The victim is a small (~6 employee) Oxnard, California-based communications integrator founded in 1978, specializing in two-way radio systems for police and fire departments, microwave links, fiber optics, and FCC licensing services. The company has a documented history of government contracts including work for Ventura County, Stanislaus County, the Port of Los Angeles police radio system, the City of Oxnard, USGS, and five Department of Defense contracts, though current annual revenue is estimated at only $1–5M.
The listing, discovered 2026-10-16 with an estimated attack date of 2026-10-14, contains no technical details on the intrusion vector, data exfiltrated, or ransom demand — only DNS/SPF records for the domain (ptelcom.com using smtp2go.com for email). No cloud/SaaS services were detected as part of the victim's infrastructure. Given the victim's past work on public-safety and DoD-adjacent communications systems, downstream exposure risk for those government and defense customers should be assessed even though the breach itself appears limited to this small integrator.
Defenders in the communications/radio integration space, and any government agencies or municipalities that have contracted with Telcom, Inc., should monitor for data leak disclosures from the TheGentlemen group and review any shared credentials, VPN access, or data-sharing arrangements with this vendor.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://www.ransomware.live/id/UGV0cm9sZXVtIFRlbGNvbSBDb21tdW5pY2F0aW9uc0B0aGVnZW50bGVtZW4=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs