News report

# The Gentlemen ransomware now uses SystemBC for bot-powered attacks

BleepingComputer, April 20, 2026. SystemBC's continued operation well after Operation Endgame: Check Point Research counts a botnet of over 1,570 victims skewed to corporate environments, and the article recalls Black Lotus Labs' finding of roughly 1,500 commercial VPS infections a day..

**Source type:** News report

**Published:** April 20, 2026

**Research grade:** S2

**Used in entries:** 1

## Bibliographic record

**Publisher:** BleepingComputer

**Published:** April 20, 2026

**Source type:** News report

**Research grade:** Source grade S2

**Language:** English

**Official record:** Not an official publication

**Address:** [https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/](https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/)

**What it supports:** SystemBC's continued operation well after Operation Endgame: Check Point Research counts a botnet of over 1,570 victims skewed to corporate environments, and the article recalls Black Lotus Labs' finding of roughly 1,500 commercial VPS infections a day.

**Dataset id:** src\_bleepingcomputer\_gentlemen\_systembc\_2026

## Research notes

- By Bill Toulas. JSON-LD datePublished 2026-04-20T16:02:37-04:00; page date line 'April 20, 2026'.
- The 1,500-bots-a-day figure here is a back-reference to Lumen Black Lotus Labs' September 2025 research, already held as src\_bleepingcomputer\_systembc\_proxy\_highway; the new number in this article is Check Point's 1,570+ victims.
- Do not conflate the two counts - they are different measurements by different vendors a year apart.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[SystemBC proxy network continued operation](https://takedownindex.org/takedowns/operation-endgame-wave-1)

Same operators, Operation Endgame wave 1

Later outcome

[All sources](https://takedownindex.org/sources)