The social media page for the medical chain, which has four hospitals and other clinics in Georgia and South Carolina, was removed from Facebook shortly after a series of messages claiming to be from “The Gentlemen” ransomware group appeared. It is believed to have been founded by a former affiliate of the Qilin ransomware group who uses the moniker “hastalamuerte.” According to the cybersecurity firm CheckPoint, its ransomware was used to extort 332 victims in the first five months of this year alone. Once inside, they attempt to get access to administrator accounts and to disable security tools before exfiltrating data and deploying ransomware. In one instance observed by the security firm Expel, the group abused a vulnerability in an “obscure” third-party vendor driver to disable the victim’s EDR.