---
id: 6191
title: "TheGentlemen Ransomware Toolkit Found on Russian Proton66 Server"
source_domain: hunt.io
source_url: "https://hunt.io/blog/thegentlemen-ransomware-toolkit-russian-proton66-server"
published_at: "2026-03-24T00:00:00Z"
tags: ["secrets", "threat-intelligence", "malware", "ransomware", "mimikatz", "open-directory", "thegentlemen", "proton66"]
phying_url: "https://phying.com/item/6191"
lang: en
---

# TheGentlemen Ransomware Toolkit Found on Russian Proton66 Server

## Summary

A live TheGentlemen ransomware toolkit surfaced on Russian bulletproof host Proton66: 126 files with victim hashes in Mimikatz logs, a 35 KB pre-deployment script, and plaintext ngrok tokens.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-03-24T00:00:00Z
- **Original:** https://hunt.io/blog/thegentlemen-ransomware-toolkit-russian-proton66-server
- **Phying News:** https://phying.com/item/6191