The Gentlemen — Ransomware Profile
The Gentlemen is a ransomware-as-a-service operation that emerged in July–August 2025 (Microsoft tracks its operators as Storm-2697) and scaled rapidly by offering affiliates a 90% revenue share. It runs a cross-platform, Go-based locker obfuscated with Garble against Windows, Linux, ESXi, NAS, and BSD systems, using Curve25519/XChaCha20 encryption and self-propagating, worm-like lateral movement. Affiliates gain entry via exposed edge devices and exploitation of CVE-2024-55591, CVE-2025-32433, CVE-2025-33073 and CVE-2025-55182, then abuse Group Policy and the NETLOGON share for domain-wide deployment. Defense evasion relies on BYOVD through the vulnerable ThrottleStop/ThrottleBlood.sys driver (CVE-2025-7771) and the purpose-built GentleKiller EDR killer. The group practices double extortion; a May 2026 leak of its "Rocket" backend database exposed operator chats, and an affiliate's compromised SystemBC C2 server revealed more than 1,570 linked victims beyond public listings.Also tracked as
Storm-2697, Thegentlemen
IntelFusions coverage (25)
- Ransomware crews turn on Chile after months of quiet 2026-08-29 · Cyber Incidents
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
- Mexico is suddenly all over the ransomware leak sites 2026-08-22 · Cyber Incidents
- Akira reboots PCs into Safe Mode to blind security tools 2026-08-19 · Ransomware
- Ransomware's top crews lose ground as 93 groups pile in 2026-08-13 · Ransomware
- Ransomware crews pile onto Italy's industrial firms 2026-08-13 · Cyber Incidents
- Ransomware claims against Indian firms tripled in a month 2026-08-12 · Cyber Incidents
- Latin America's public bodies keep appearing on leak sites 2026-08-08 · Cyber Incidents
- Gentlemen ransomware ends Qilin's 13-month reign on top 2026-08-02 · Ransomware
- Qilin claims one of America's oldest magazines 2026-08-02 · Ransomware
- Colombia warns on Gentlemen ransomware as 30 victims land in a day 2026-07-26 · Ransomware
- The Gentlemen ransomware lists Colombia's Ecopetrol and a US Navy command 2026-07-19 · Ransomware
- Interlock ransomware claims a DC housing agency and a refugee charity 2026-07-17 · Ransomware
- DragonForce ransomware posts more than 20 victims in three days 2026-07-17 · Ransomware
- The Gentlemen ransomware dumps nearly 20 victims in a single day 2026-07-17 · Ransomware
- The Gentlemen ransomware lures affiliates with rare 90 percent payouts 2026-07-11 · Ransomware
- New WhiteLock ransomware kills remote tools to block recovery 2026-07-08 · Ransomware
- Ransomware crews pile onto US healthcare providers over the July 4 weekend 2026-07-04 · Ransomware
- Gentlemen ransomware crew names 41 victims in a single day 2026-07-04 · Ransomware
- Gentlemen ransomware gang builds custom backdoor and stealthy network spying 2026-06-29 · Ransomware
- Ransomware gang claims to hit German submarine builder Thyssenkrupp 2026-06-28 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
- Ransomware affiliate hides a malicious Edge extension to hijack victim PCs 2026-06-23 · Ransomware
- Ransomware crew Gentlemen arms affiliates with custom EDR killers 2026-06-19 · Ransomware
- New ransomware crew The Gentlemen claims 20 victims in one week 2026-06-12 · Ransomware
Tools & malware
- Advanced IP Scanner discovery
- All.exe defense evasion
- Allpatch2.exe defense evasion
- AnyDesk remote access (RMM)
- GentleKiller EDR killer
- NetExec discovery
- Nmap discovery
- PowerRun.exe privilege escalation
- PsExec lateral movement
- SharpADWS discovery
- SystemBC C2 proxy
- ThrottleBlood.sys EDR killer (BYOVD)
- WinSCP exfiltration tool
Recent claimed victims
- Placer AI 2026-10-12
- BigID 2026-10-12
- Confluent 2026-10-12
- MoneyGram 2026-10-12
- KFC 2026-10-12
- Royal Thai Air Force 2026-10-10
- DW McMillan Memorial Hospital 2026-10-09
- Saskatoon Tribal Council 2026-10-09
- Aquatech 2026-10-09
- AnyTech365 2026-10-09
- Greenbrook Engineering 2026-10-09
- TGN 2026-10-09
- Galil Engineering 2026-10-09
- Smart Value 2026-10-09
- Kooltronic 2026-10-09
- Skyplan Services 2026-10-09
- Refako Autodele 2026-10-09
- SAS H2O MICHEL 2026-10-09
- Husky Ltee 2026-10-09
- Asessippi Ski Resort 2026-10-09
- PIR Sales 2026-10-09
- Jentech Precision Industrial 2026-10-09
- Santee School District Foundation 2026-10-09
- University of Buraimi 2026-10-09
- Ansonia Public Schools 2026-10-09
Vendor research
- a new investigation by CloudSEK's TRIAD research team CloudSEK
- Gentlemen Ransomware (Protection Bulletin) Symantec (Broadcom)
- the original report from Check Point Research Check Point Research
- No Manners Here: The Ruthless Rise of The Gentlemen Ransomware Unit 42
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptor Microsoft
- Thus Spoke…The Gentlemen Check Point
- Unmasking the Gentlemen Ransomware Group Trend Micro
Countries linked to this actor
- Kenya targets