From Conti to The Gentlemen: tooling evolved, gaps didn't

Analysis of four major ransomware leaks (Conti 2022, Black Basta 2025, LockBit 2025, The Gentlemen 2026) reveals that while operator tactics evolved—moving from centralized firms to distributed crews and adopting AI for negotiation and coding—their core attack methodology remained unchanged, exploiting five persistent gaps: edge authentication via CVE exploitation, browser credential theft, domain controller backup access, hypervisor blindspots, and cloud exfiltration via rclone to MEGA.