// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE BRC-wedgDTG 0600Z
ColdRecon / Breach Radar / Microsoft
Breach Record

Microsoft

DISCLOSED 2026-05-21 · RANSOMWARE · RANSOMWARE

Huntress investigated two incidents in April and May 2026 involving The Gentlemen ransomware-as-a-service operation. In both cases, attackers cleared Security, System, and Application Event Logs and used PowerShell to disable Microsoft Defender and add antivirus exclusions. A leak of the operation's internal chats revealed additional evasion tools and techniques.

The record

What we know

Disclosed
2026-05-21
Attack vector
Ransomware
RANSOMWARE
Sources

Cited reporting

↗ Huntress (2026-05-21)
Similar vector · recent

Other ransomware breaches on file

River Bank · 2026-08-04 American Bank · 2026-08-04 Analog Devices · 2026-08-03 Asopagos S.A. · 2026-06-01 VVO Finance · 2026-06-01 Beacon Mutual · 2026-06-01 Carnival · 2026-05-31 Vodafone · 2026-05-31

This page is the permanent ColdRecon entry for the Microsoft disclosure. It updates if new public reporting emerges. All tracked breaches →

Microsoft just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →