The Gentlemen — Ransomware Profile
The Gentlemen is a ransomware-as-a-service operation that emerged in July–August 2025 (Microsoft tracks its operators as Storm-2697) and scaled rapidly by offering affiliates a 90% revenue share. It runs a cross-platform, Go-based locker obfuscated with Garble against Windows, Linux, ESXi, NAS, and BSD systems, using Curve25519/XChaCha20 encryption and self-propagating, worm-like lateral movement. Affiliates gain entry via exposed edge devices and exploitation of CVE-2024-55591, CVE-2025-32433, CVE-2025-33073 and CVE-2025-55182, then abuse Group Policy and the NETLOGON share for domain-wide deployment. Defense evasion relies on BYOVD through the vulnerable ThrottleStop/ThrottleBlood.sys driver (CVE-2025-7771) and the purpose-built GentleKiller EDR killer. The group practices double extortion; a May 2026 leak of its "Rocket" backend database exposed operator chats, and an affiliate's compromised SystemBC C2 server revealed more than 1,570 linked victims beyond public listings.Also tracked as
Storm-2697, Thegentlemen
IntelFusions coverage (25)
- Ransomware crews turn on Chile after months of quiet 2026-08-29 · Cyber Incidents
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
- Mexico is suddenly all over the ransomware leak sites 2026-08-22 · Cyber Incidents
- Akira reboots PCs into Safe Mode to blind security tools 2026-08-19 · Ransomware
- Ransomware's top crews lose ground as 93 groups pile in 2026-08-13 · Ransomware
- Ransomware crews pile onto Italy's industrial firms 2026-08-13 · Cyber Incidents
- Ransomware claims against Indian firms tripled in a month 2026-08-12 · Cyber Incidents
- Latin America's public bodies keep appearing on leak sites 2026-08-08 · Cyber Incidents
- Gentlemen ransomware ends Qilin's 13-month reign on top 2026-08-02 · Ransomware
- Qilin claims one of America's oldest magazines 2026-08-02 · Ransomware
- Colombia warns on Gentlemen ransomware as 30 victims land in a day 2026-07-26 · Ransomware
- The Gentlemen ransomware lists Colombia's Ecopetrol and a US Navy command 2026-07-19 · Ransomware
- Interlock ransomware claims a DC housing agency and a refugee charity 2026-07-17 · Ransomware
- DragonForce ransomware posts more than 20 victims in three days 2026-07-17 · Ransomware
- The Gentlemen ransomware dumps nearly 20 victims in a single day 2026-07-17 · Ransomware
- The Gentlemen ransomware lures affiliates with rare 90 percent payouts 2026-07-11 · Ransomware
- New WhiteLock ransomware kills remote tools to block recovery 2026-07-08 · Ransomware
- Ransomware crews pile onto US healthcare providers over the July 4 weekend 2026-07-04 · Ransomware
- Gentlemen ransomware crew names 41 victims in a single day 2026-07-04 · Ransomware
- Gentlemen ransomware gang builds custom backdoor and stealthy network spying 2026-06-29 · Ransomware
- Ransomware gang claims to hit German submarine builder Thyssenkrupp 2026-06-28 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
- Ransomware affiliate hides a malicious Edge extension to hijack victim PCs 2026-06-23 · Ransomware
- Ransomware crew Gentlemen arms affiliates with custom EDR killers 2026-06-19 · Ransomware
- New ransomware crew The Gentlemen claims 20 victims in one week 2026-06-12 · Ransomware
Tools & malware
- Advanced IP Scanner discovery
- All.exe defense evasion
- Allpatch2.exe defense evasion
- AnyDesk remote access (RMM)
- GentleKiller EDR killer
- NetExec discovery
- Nmap discovery
- PowerRun.exe privilege escalation
- PsExec lateral movement
- SharpADWS discovery
- SystemBC C2 proxy
- ThrottleBlood.sys EDR killer (BYOVD)
- WinSCP exfiltration tool
Recent claimed victims
- Seasia Infotech 2026-09-02
- CareerSource Palm Beach County 2026-09-01
- Nutex Health 2026-09-01
- The Sole 2026-09-01
- EP Manufacturing Bhd 2026-08-31
- Saudi Consulting Services SAUD CONSULT 2026-08-31
- Glassdoor 2026-08-30
- G R Infraprojects 2026-08-30
- Northwest Trophy 2026-08-30
- General Gruppo 2026-08-30
- Ixa Systems 2026-08-30
- Tecno Accion 2026-08-30
- Probe Test System 2026-08-30
- SUNSEA 2026-08-30
- Thai Film Industries PCL 2026-08-30
- Adkisson Group 2026-08-30
- ESB Puerto Rico Corp 2026-08-30
- Nutrypollo 2026-08-30
- Brebur 2026-08-30
- MB Associates 2026-08-30
- Exacta Optech Labcenter 2026-08-30
- Servicios Aereos Estrella 2026-08-30
- Zion Construction 2026-08-27
- Party Rental 2026-08-26
- TEC Container 2026-08-26
Vendor research
- the original report from Check Point Research Check Point Research
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptor Microsoft
- No Manners Here: The Ruthless Rise of The Gentlemen Ransomware Unit 42
- Thus Spoke…The Gentlemen Check Point
- Unmasking the Gentlemen Ransomware Group Trend Micro
Countries linked to this actor
- Kenya targets