Check Point researchers accessed a SystemBC command-and-control server tied to The Gentlemen ransomware-as-a-service operation, revealing more than 1,570 compromised corporate networks, the vast majority never publicly disclosed. The group has operated since July 2025, targeting Windows, Linux, VMware ESXi, Hyper-V, NAS, and BSD environments across heterogeneous enterprise infrastructure. The gap between 320 publicly claimed victims and 1,570+ C2-confirmed victims indicates that most compromised organizations are in an active dwell phase, exposing them to data theft, pre-ransomware staging, and selective extortion – threats that remain hidden until deployment or extortion demand.