Boyd Tech Solutions

A ransomware group called "The Gentlemen" is one of the fastest-growing names in cybercrime right now. You probably haven't heard of them.

In April 2026, The Gentlemen accounted for roughly 10% of all logged ransomware attacks worldwide and climbed into the top three most active ransomware operations, alongside Qilin and DragonForce. One of their named victims that month was Adaptavist, an Atlassian platinum partner that serves thousands of business customers.

This shift matters because the names you might already know are out of the picture. LockBit, Conti, REvil, and Hive are all gone or rebranded after law enforcement crackdowns and infighting. The replacements use different aliases but the same tactics: phishing, credential theft, vulnerable VPN appliances, and unpatched servers. They encrypt your data and steal a copy to threaten you twice.

The good news is that the defense looks the same regardless of which group is hitting your industry. Five things work against all of them: patching CISA KEV systems within two weeks, MFA with number matching on internet-facing systems, immutable offsite backups that you actually test, security tools that watch for behavior instead of relying on known viruses, and phishing training that covers 2026 forms like QR codes, voice cloning, and fake CAPTCHA pages.

You can't keep up with which ransomware group is hot this month, and you don't have to. The defenses that work today will still work when The Gentlemen rebrand into something else next year.

Cyber Threats Spike in April 2026 as Ransomware Expands and Attack Volumes Climb After Short-Lived Moderation - Check Point Blog April 2026 Cyber Attack Trends: Ransomware & GenAI Risks Surge Every Region Recorded Higher Attack Volumes in April In April 2026, global cyber-attack activity rebounded sharply following the brief moderation observed Global cyberattacks rose 10% in April 2026 as ransomware expanded and GenAI risks persisted. See key trends across sectors, regions, and industri...

Most of the tools your team uses to get work done are probably not on your IT list.

Some examples: personal Dropbox accounts for client files, ChatGPT with confidential information pasted in, a Trello board the marketing team set up a year ago, a Notion workspace someone in operations runs from their phone. The name for all of this is shadow IT, and every business has more of it than you'd guess.

The risk shows up in two places. First, data that should live inside your business sits inside accounts you don't control and can't delete. When an employee leaves, the data stays where they put it. Second, none of those tools are configured with your security in mind. MFA settings are weak or off, and there's no data loss prevention, retention policy, or audit log to check when something goes wrong.

You don't need a top-down crackdown to fix this. Ask four questions in your next team meeting:

1. What software or web tool are you using this week that wasn't installed by IT?
2. Which one would slow your work down the most if it disappeared tomorrow?
3. Is any client or company data sitting in it?
4. Would you be embarrassed if it leaked in a breach?

Run the conversation as a fact-finding exercise. The helpful tools get sanctioned, the risky ones get replaced.

If you don't know what's running in your business, you can't protect it.

Windows 10 hit end of life on October 14, 2025. Microsoft stopped sending free security updates that day.

Every new vulnerability discovered since then sits unpatched on every Windows 10 machine that isn't enrolled in Microsoft's paid Extended Security Updates program. The list grows every month. Attackers know exactly which versions of Windows have which holes, and they go after the easiest ones first.

If you still have Windows 10 machines in your business, you have three options.

Upgrade to Windows 11. Most computers made in the last 4 to 5 years can run it. The upgrade itself is free if your license is genuine. The main cost is the time to plan it. For most businesses this is the right answer.

Pay for Extended Security Updates. Microsoft sells ESU to businesses at $61 per device for year one. That price doubles in year two and again in year three. ESU keeps the patches coming, but the vulnerability count keeps climbing and you pay more each year to stay current.

Replace the hardware. If a computer can't run Windows 11, it's old enough that it was due for replacement anyway. The longer you wait, the more it costs you in lost productivity.

The one option that isn't on the list is keeping Windows 10 and hoping nothing happens.

If someone asks whether your business has backups, you probably say yes. Disaster recovery is a different question.

A backup is a copy of your data. Disaster recovery is the plan that brings your business back to running condition after something goes wrong. The two get confused all the time, and the confusion costs real money when ransomware or a hardware failure hits.

A good backup setup follows the 3-2-1-1-0 rule: three copies of every important file, on two different types of storage, with one copy stored offsite, one copy that's immutable so ransomware can't encrypt it, and zero errors in your last test restore.

That last one is what most businesses skip. Untested backups are not backups.

They're an unverified promise.

Pick a normal file, an email, and a full server volume, then try to restore each one to a different location.

If the restore works, you have backups. If it doesn't, you have a problem you can fix today instead of during an attack.

Disaster recovery goes one layer further. It's the playbook for what your business does when it can't function. Things like which systems come back first, which people make decisions, which vendors get called, and how long each step is supposed to take. Without that playbook, even a working backup leaves you guessing during the worst week of your year.

In April 2026, ransomware hit Adaptavist, an Atlassian platinum partner that builds and supports tools for thousands of business customers.

Adaptavist makes ScriptRunner and similar add-ons that plug into Atlassian products like Jira and Confluence. When attackers got into Adaptavist's systems, every customer connected to those tools was suddenly downstream of a breach they didn't cause.

This is the supply chain attack pattern. Your business doesn't have to be the target. It just has to share a vendor with the target.

Three things worth doing this month:

-Make a one-page list of every SaaS vendor your business depends on. Email, accounting, payroll, CRM, helpdesk, file storage, project management. The list is usually longer than you'd expect.
-For each vendor, find their security and breach notification page online. If you can't find it in five minutes, that's information worth knowing.
-For the top five vendors by data sensitivity, ask three questions in writing: do you have a current SOC 2 Type II report, what's your breach notification SLA, and how do you handle credentials inside your support tooling.

You can't control every vendor's security. Pick the ones that take it seriously.

Adaptavist Group breach: Ransomware crew claims mega-haul : Fake emails already doing the rounds as ransomware crew boasts about what it allegedly stole