An extortion crew called The Gentlemen has put three Thai public names on its leak site in under a week, starting with the Royal Thai Air Force. The air force appeared on 10 October, according to the independent tracker ransomware.live's record of the listing, which ties the post to the service's official web domain, rtaf.mi.th. On 16 October the same crew added Museum Siam, the Bangkok museum run by the state's National Discovery Museum Institute (tracker record), and Thai Ha PCL, the rice and noodle exporter behind the KASET brand (tracker record). The tracker estimates that both of those intrusions took place on 14 October.
None of the three organisations had publicly confirmed an incident that we could find at the time of writing. Every one of these listings is a claim written by the gang itself, and the tracker records describe each victim without saying what data, if any, was taken.
Not the first military name on this site
The air force is not the first Thai defence-linked name The Gentlemen has posted. Our incident tracking shows the crew listed the Royal Thai Navy Housing Cooperative on 1 July. A housing cooperative is a long way from an operational command, and nothing in either listing points to access to military systems: the air force entry references the service's public web portal. A crew that keeps returning to the edges of the Thai armed forces is still worth watching.
That interest sits alongside, not inside, a separate pattern. Thailand has also drawn state-backed espionage tied to its border dispute with Cambodia, including the Mustang Panda USB worm campaign we covered in February. The Gentlemen is tracked as a financially motivated ransomware operation, and nothing in its listings ties it to that activity.
Thailand is a repeat stop for this crew
Thailand is a modest presence in global leak-site data, but a recurring one for The Gentlemen. Our tracking holds more than two dozen of the crew's listings against Thai organisations since March. The peak came in April, when it accounted for 11 of the 18 Thai claims we recorded that month, and its earlier Thai victims include Thai Film Industries PCL, listed at the end of August. This month it is behind half of the six Thai claims recorded so far.
Across every country, the crew has posted 130 claims in the last 30 days, which makes it one of the busiest extortion brands of the year. It was also one of two crews that listed Ecuador's National Police this week, another public body named without any stolen data on show. Its profile sits on our The Gentlemen actor page.
What a listing does and does not prove
A leak-site post is how an extortion crew applies pressure, and it is published before any negotiation is settled. Some turn out to be accurate, some recycle data from older breaches, and some exaggerate access to a single website or supplier into a claim against a whole institution. The three Thai entries are, for now, statements by the gang. Data published later, or a confirmation from one of the organisations, would change that.
Treat the claims as live until the organisations say otherwise
Staff of the three organisations should treat unexpected messages that reference internal matters, invoices or personal details with suspicion, and their partners and suppliers should watch for phishing that borrows their names. Under Thailand's Personal Data Protection Act, an organisation that confirms a personal data breach must notify the Personal Data Protection Committee, within 72 hours where feasible, and ThaiCERT and the National Cyber Security Agency coordinate national incident response. Country context sits on our Thailand page.
Three listings in a week say more about where this crew is looking than about what it holds. Until it publishes data, the air force entry is a headline the gang wrote for itself.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.