Ransomware Crew’s Extortion Playbook Exposed

Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure on customers and partners, and threatened publication of stolen data.

Key findings

• The exposed records describe an extortion process that starts with text-only emails to company owners or executives and escalates to scripted voice calls, outreach to customers and partners, regulatory pressure, and publication threats.
• The operators allegedly used stolen financial and compliance data to estimate how much a victim could pay and to make threats more persuasive.
• A four-message extortion package signed “The Gentlemen” included a voice-call plan for Leo Schachter Diamonds.
• A look-alike website, trulitesupport[.]com, was reportedly used to warn Trulite customers about a breach and pressure the company.
• The groups primarily gained access through exploitation of remote-access and edge systems, then harvested credentials and targeted finance, HR, legal, and executive files.

Who’s being targeted

• Commonly targeted roles: Executives, Business owners, Finance, Legal, Human resources, Corporate communications, Customer support, Incident response teams, IT and security teams.
• Affected industries: Manufacturing, Healthcare, Hosting providers, Professional services, Finance, Retail and luxury goods.
• Attack channels: email, vishing, website.
• Impersonated: The Gentlemen ransomware group, Trulite support or incident-response function.

Awareness takeaways

• Treat unexpected breach notifications and demands for urgent responses as potential extortion attempts; report them through the company’s incident-response process rather than replying directly.
• Train executives and owners to verify alleged data-breach claims through established legal, security, and communications contacts before engaging with a caller or sender.
• Tell employees and customers to use only official company domains and known contact channels for security notices; look-alike support sites can be used to create panic and apply pressure.
• Prioritize protection of finance, HR, legal, executive, compliance, and customer data because criminals can use it to tailor extortion demands and public-pressure campaigns.

Red flags to watch for

• An unsolicited breach claim from an unknown sender
• Pressure to respond within a short deadline
• A threat to contact customers, partners, regulators, or publish data
• The notice is hosted on a look-alike domain rather than the company’s official website
• The page links to a ransomware leak post
• The communication appears designed to create public pressure rather than provide verified incident updates