Qilin and The Gentlemen Drive Manufacturing Victims Up

ReliaQuest reported that manufacturing victims posted on leak sites rose 70% in the third quarter of 2026. The increase was driven largely by Qilin, a ransomware-as-a-service operation, and The Gentlemen, an affiliate-based operation. At the same time, victim postings in the United States rose 9%, while about 85% of the overall increase came from victims outside the country.

What does ReliaQuest show about manufacturing?

ReliaQuest attributed the growth to two groups that expanded their activity against the sector. The Gentlemen went from 49 to 74 manufacturing victims, and Qilin from 50 to 71, according to its ransomware and digital extortion report for the third quarter of 2026. The firm did not present those figures as independently confirmed compromises, but as postings observed on leak sites.

The report also broke out the geographic trend. In the United States, victim-linked postings rose 9%, but most of the movement was seen outside that market. That distribution suggests the spike was not concentrated in a single country, but spread across multiple geographies.

What Latin American cases appear in the records?

Comparitech recorded in October 2026 an Argentine organization, Recursos y Energía Formosa S.A. (REFSA), as claimed by NightSpire. It also identified Brazil's Companhia de Habitação Popular de Campinas (Cohab-Campinas) as affected by unidentified hackers. The source did not document technical TTPs for those cases, nor did it link those victims to the United States.

During the same period, Brandefense said its tracker logged 74 alerts with victim names associated with The Gentlemen since October 25, 2026, and noted activity tied to Mato Grosso, Brazil. However, the available result does not on its own confirm that a specific organization was compromised.

What other reports reinforce Qilin and The Gentlemen activity?

A technical analysis citing research from Group-IB, NyxLab and Unit 42 described overlaps in victims between The Gentlemen and Qilin, although it said a direct affiliation or a relationship with an access broker had not been confirmed. The same analysis attributed to Unit 42 the assessment that The Gentlemen may previously have operated as Qilin affiliate ArmCorp, identified by Unit 42 as Spikey Scorpius.

Breachsense, meanwhile, recorded 135 claimed victims by TheGentlemen and 110 by Qilin during October 2026. Both figures come from leak site listings and do not necessarily mean the organizations were independently confirmed as compromised.

The New Jersey Cybersecurity and Communications Integration Cell also reported ransomware incidents affecting public and private organizations in New Jersey, attributed to operations such as Qilin, INC Ransom and SafePay. Its report described file and server encryption, data exfiltration and threats to publish stolen information.