RegistroCiberVE
All incidents
unconfirmed ransomware listing Claim date: Date confidence: Medium

Presunta extorsión de The Gentlemen contra C.H. Express

C.H. Express, chxpress.com.ve, apareció entre once tarjetas atribuidas al portal de The Gentlemen en una imagen publicada el 26 de marzo de 2026. Otros rastreadores registraron el mismo objetivo el 6 y el 19 de abril, y una nota del 20 de abril reprodujo una amenaza genérica de publicar información si la empresa no contactaba al actor. Un rastreador marca su ficha como duplicada, aunque no existe otro incidente local de C.H. Express. Las fuentes documentan el listado y la amenaza; no muestran archivos, datos, una nota de rescate específica, acceso, ejecución de malware, cifrado, exfiltración, interrupción o pérdidas. No se encontró una declaración pública de la empresa. Las fechas corresponden a publicaciones y detecciones, no a una intrusión confirmada.

Overview

Missing evidence

confirmación o respuesta pública de C.H. Expresscaptura preservada directamente desde el portal del actor con cadena de custodiaarchivos o datos autenticados y hashes verificablesevidencia técnica de acceso, malware, cifrado o exfiltraciónevidencia de interrupción, recuperación o pérdida materialfecha y vector de compromiso verificables

Impact details

DeXpose repite una amenaza genérica de publicación, pero ninguna fuente muestra o autentica datos o archivos. No se confirmó intrusión, malware, cifrado, extracción, publicación, interrupción o pérdida. La disponibilidad operacional permanece desconocida; no equivale a continuidad normal confirmada.

Classification & severity

Category
Undetermined
Subtype
unconfirmed ransomware listing
Confidence
Low

La imagen pública de monitoreo confirma que el portal de The Gentlemen incluyó a C.H. Express, pero ninguna fuente demuestra acceso, malware ejecutado, cifrado, exfiltración o interrupción.

Severity assessment

Information impact
Suspected
Affected scope
Organization-wide
Critical service
None
Public confidence
Limited

La consecuencia potencial sería material si el reclamo fuera auténtico, pero la evidencia específica sólo confirma una tarjeta de objetivo y una amenaza derivada sin archivos ni impacto comprobado.

Data exfiltration· Claimed

Timeline

Claim

C.H. Express aparece entre once objetivos del portal atribuido a The Gentlemen en una imagen pública; documenta el listado, no una intrusión o ransomware ejecutado.

Evidence & sources

6 sources

Ransomware.live — CH Express / The Gentlemen

Ransomware.live Apr 19, 2026
Corroborating Security research Source confidence: Medium

What this source supports

  • Ransomware.live indexes CH Express, chxpress.com.ve and Thegentlemen
  • the tracker records discovery on 19 April and an estimated 26 March date

Evidence limits

Tracker metadata only. Its estimated date is unexplained; its duplicate flag does not identify another local registry incident. FortiBleed and infostealer panels are separate exposure signals and not evidence of this claim.

Relevance to this case

Corroborates target-listing metadata, not an intrusion, ransomware execution, encryption, exfiltration or impact.

The Gentlemen Target Venezuelan Logistics Firm C.H. Express

DeXpose / intelfeeds Apr 20, 2026
Corroborating Security research Source confidence: Low

What this source supports

  • DeXpose reports a The Gentlemen claim naming C.H. Express and chxpress.com.ve
  • the article repeats a generic threat to publish information unless the target contacts the actor

Evidence limits

Derivative commercial alert based on public dark-web and threat-intelligence feeds. It supplies no actor artifact, files or technical validation.

Relevance to this case

Supports circulation of the listing and publication threat only.

Ransomware Group Thegentlemen Hits CH Express

HookPhish Team Apr 19, 2026
Corroborating Security research Source confidence: Low

What this source supports

  • HookPhish indexes CH Express, chxpress.com.ve, Venezuela and The Gentlemen
  • its public-feed metadata records 26 March and 19 April dates

Evidence limits

HookPhish explicitly derives the entry from public threat-intelligence feeds and says it does not obtain or verify stolen information. Its breach date is feed metadata, not an independently established compromise date.

Relevance to this case

Derivative listing/date context only; does not confirm the claimed incident.

CH Express — HackNotice incident link

HackNotice
Context Security research Source confidence: Low

What this source supports

No supported claims are recorded for this source.

Evidence limits

The exact URL currently exposes no incident-specific title, body, publisher date, account, artifact or claim.

Relevance to this case

Inaccessible provenance pointer only. Candidate for later source retirement with explicit approval; it provides no independently inspectable support.

Feed de noticias de ciberseguridad — 6 de abril de 2026

CronUp Ciberseguridad Apr 6, 2026
Corroborating Media report Source confidence: Medium

What this source supports

  • CronUp's dated feed visibly lists CH Express with the gentlemen on 6 April 2026

Evidence limits

Secondary feed derived from public ransomware monitoring. Its table date supports publication/listing context and is not an independently verified intrusion date.

Relevance to this case

Earliest accessible secondary feed corroborating that CH Express was listed with The Gentlemen.

FalconFeeds.io — The Gentlemen added CH Express among 11 targets

FalconFeeds.io (@FalconFeedsio) Mar 26, 2026
Primary Social media Source confidence: Medium

What this source supports

  • FalconFeeds visibly reported that The Gentlemen added 11 victims and named C.H. Express C.A.
  • the sole image visibly shows a The Gentlemen portal card for C.H. Express and chxpress.com.ve among eleven target cards

Evidence limits

The exact post and image establish public listing provenance. The card contains company/domain text and a countdown but no files, data, access evidence, ransom note, ciphering or outage proof.

Relevance to this case

Strongest accessible target-specific evidence for the actor-portal listing, not the underlying incident.