{"id":1150,"date":"2026-08-04T15:30:00","date_gmt":"2026-08-04T15:30:00","guid":{"rendered":"https:\/\/cyberasia.io\/article\/blog\/thegentlemen-ransomware-claims-attack-amicell-israel\/"},"modified":"2026-08-17T11:07:25","modified_gmt":"2026-08-17T11:07:25","slug":"thegentlemen-ransomware-claims-attack-amicell-israel","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ransomware\/thegentlemen-ransomware-claims-attack-amicell-israel\/","title":{"rendered":"TheGentlemen Ransomware Claims Attack on Israeli Battery Maker Amicell"},"content":{"rendered":"

The ransomware collective operating under the designation TheGentlemen<\/strong> has purportedly listed Israeli energy solutions manufacturer Amicell , Amit Industries Ltd.<\/strong> on its dark web extortion portal. The group claims to have successfully infiltrated the company\u2019s internal networks and exfiltrated a significant volume of sensitive corporate data. The alleged listing was first detected on July 31, 2026, alongside threats to publish the stolen files if Amicell refuses to enter into ransom negotiations.<\/p>\n

\"TheGentlemen<\/p>\n

Amicell (Amit Industries Ltd.) specializes in the design and manufacture of advanced custom battery packs and Battery Management Systems (BMS) for industrial, commercial, and defense-adjacent applications. The specialized nature of their manufacturing operations lends added severity to any potential compromise of intellectual property or supply chain data. As of early August 2026, the claims remain unverified, and Amicell has not issued a public statement regarding the incident.<\/p>\n

Threat Context: TheGentlemen Ransomware Operations<\/h2>\n

TheGentlemen<\/strong> is a financially motivated Ransomware-as-a-Service (RaaS) operation that first emerged in the mid-2025 cyber threat landscape. According to independent threat intelligence trackers, the group was tied for the highest number of claimed victims (119) globally in July 2026, demonstrating a highly aggressive and rapidly expanding operational tempo.<\/p>\n

Security analysts note that TheGentlemen affiliates differentiate themselves through the use of sophisticated custom tooling designed to evade modern endpoint detection and response (EDR) solutions. A hallmark of their recent campaigns involves the deployment of Bring-Your-Own-Vulnerable-Driver (BYOVD)<\/strong> attacks. By installing legitimately signed but inherently vulnerable kernel-level drivers, the attackers can effectively disable or blind corporate antivirus and EDR agents before executing their encryption payloads.<\/p>\n

Industrial and Energy Sectors in the Crosshairs<\/h2>\n

The targeting of Amicell aligns with a broader trend of ransomware operators focusing heavily on the manufacturing and energy sectors. These industries rely on complex supply chains and just-in-time production schedules, making them highly sensitive to operational downtime. Threat actors leverage this urgency, calculating that industrial firms are more likely to pay extortions to avoid catastrophic disruptions to production lines and delayed client deliverables.<\/p>\n

In addition, Israel\u2019s industrial sector has faced a heightened threat landscape throughout 2026, enduring both financially motivated RaaS attacks and state-aligned hacktivist campaigns aiming to disrupt the nation\u2019s critical economic infrastructure.<\/p>\n

Actionable Defense: Mitigating BYOVD and RaaS Threats<\/h2>\n

For industrial manufacturers operating in high-threat environments, defending against sophisticated groups like TheGentlemen requires moving beyond basic perimeter defenses. Organizations should consult the NIST Cybersecurity Framework<\/a> to build resilient architectures.<\/p>\n

\n > TARGET_INFRASTRUCTURE<\/strong><\/p>\n