1. Home
  2. Groups
  3. The Gentlemen

The Gentlemen

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.[1][2][3][4][5][6][7][8]

ID: G1058
ⓘ
Associated Groups: Storm-2697, GOLD SHERWOOD
Version: 1.0
Created: 18 September 2026
Last Modified: 30 September 2026
Version Permalink

Associated Group Descriptions

Name Description
Storm-2697

[1]
GOLD SHERWOOD

[3]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1583 .001 Acquire Infrastructure: Domains

The Gentlemen has maintained a TOR Data Leak Site (DLS) to post stolen victim data.[3][4][5][8]
Enterprise T1486 Data Encrypted for Impact

The Gentlemen has used The Gentlemen Ransomware to encrypt victim’s data.[3][4][7][8]
Enterprise T1585 Establish Accounts

The Gentlemen and its affiliates have leveraged Tox to communicate with victims.[7][8]
.001 Social Media Accounts

The Gentlemen has established social media accounts on X.[3][5]
Enterprise T1190 Exploit Public-Facing Application

The Gentlemen has exploited vulnerable public-facing devices and services to gain access to victim environments.[2][4][6][8]
Enterprise T1068 Exploitation for Privilege Escalation

The Gentlemen has assisted affiliates with gaining privilege escalation through the use of BYOVD.[6]
Enterprise T1657 Financial Theft

The Gentlemen has used double-extortion tactics to sway victims to pay a ransom to include exfiltrating sensitive data, encrypting files, and threatening public release if a payment is not received.[1][3][4][5][6][8]
Enterprise T1683 .001 Generate Content: Written Content

The Gentlemen has utilized branded code and ransom notes.[1][2][3][5][7][8]
.002 Generate Content: Audio-Visual Content

The Gentlemen has leveraged a branded graphic that is placed on the systems desktop wallpaper that symbolizes the association of malicious activity to the group.[1][5][6]
Enterprise T1036 Masquerading

The Gentlemen has fabricated the version information of payload files to evade detection.[4]
.001 Invalid Code Signature

The Gentlemen has copied digital signatures from legitimate executables in attempts to circumvent detection.[4]
.005 Match Legitimate Resource Name or Location

The Gentlemen has named The Gentlemen Ransomware payload files to resemble well-known software vendors to include security vendors. The Gentlemen has also utilized icons that match impersonated vendors.[4]
Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

The Gentlemen has packed The Gentlemen Ransomware binaries utilizing either Themida or Enigma to obfuscate the malicious payloads.[4]
Enterprise T1588 .002 Obtain Capabilities: Tool

The Gentlemen has provided a custom EDR killing tool called GentleKiller and other like software that abuse vulnerable drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique to their affiliates that attempts to disable EDR solutions.[2][3][4][6][8]

The Gentlemen has obtained tools to include Advanced IP Scanner, the PowerRun utility and Rocket Chat communication tools.[2][3][6][8]
Enterprise T1219 .002 Remote Access Tools: Remote Desktop Software

The Gentlemen has relied on remote access tools, such as AnyDesk, as a means of maintaining access to victim environment.[8]
Enterprise T1018 Remote System Discovery

The Gentlemen has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.[2]

Enterprise T1078 Valid Accounts

The Gentlemen has leveraged compromised user credentials to gain access to victim hosts.[2][6][7]

Software

ID Name References Techniques
S0029 PsExec [8] Create Account: Domain Account, Create or Modify System Process: Windows Service, Lateral Tool Transfer, Remote Services: SMB/Windows Admin Shares, System Services: Service Execution
S9051 The Gentlemen Ransomware [1][8][7][5] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Boot or Logon Initialization Scripts: Network Logon Script, Boot or Logon Initialization Scripts: RC Scripts, Command and Scripting Interpreter: Hypervisor CLI, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data Encrypted for Impact, Data Staged: Local Data Staging, Defacement: Internal Defacement, Delay Execution, Disable or Modify System Firewall: Windows Host Firewall, Disable or Modify Tools: Clear Windows Event Logs, Disable or Modify Tools, Disk Wipe: Disk Content Wipe, Domain or Tenant Policy Modification: Group Policy Modification, Domain Trust Discovery, Downgrade Attack, ESXi Administration Command, File and Directory Discovery, File and Directory Permissions Modification: Windows Permissions, Hide Artifacts: File/Path Exclusions, Hide Artifacts: Hidden Files and Directories, Indicator Removal: Clear Command History, Indicator Removal: Clear Network Connection History and Configurations, Indicator Removal: File Deletion, Inhibit System Recovery, Local Storage Discovery, Masquerading: Masquerade Task or Service, Modify Registry, Native API, Network Share Discovery, Obfuscated Files or Information: Command Obfuscation, Obfuscated Files or Information, Prevent Command History Logging, Proxy, Remote Services: SMB/Windows Admin Shares, Remote Services: Remote Desktop Protocol, Scheduled Task/Job: Cron, Scheduled Task/Job: Scheduled Task, Selective Exclusion, Service Stop, System Services: Service Execution, System Shutdown/Reboot, Windows Management Instrumentation
S0645 Wevtutil [6] Data from Local System, Disable or Modify Tools: Disable or Modify Windows Event Log, Disable or Modify Tools: Clear Windows Event Logs

References

  1. Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.
  2. Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026.
  3. Sophos Counter Threat Unit Research Team. (2026, September 1). Ungentlemanly behavior: Insights into a ransomware operation. Retrieved September 18, 2026.
  4. Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.
  1. Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.
  2. Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026.
  3. Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.
  4. Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.