{"description": "Enterprise techniques used by The Gentlemen, ATT&CK group G1058 (v1.0)", "name": "The Gentlemen (G1058)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1583", "showSubtechniques": true}, {"techniqueID": "T1583.001", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has maintained a TOR Data Leak Site (DLS) to post stolen victim data.(Citation: Sophos_TheGentlemen_Sept2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1486", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has used [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) to encrypt victim\u2019s data.(Citation: Sophos_TheGentlemen_Sept2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1585", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) and its affiliates have leveraged Tox to communicate with victims.(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1585.001", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has established social media accounts on X.(Citation: Sophos_TheGentlemen_Sept2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1190", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has exploited vulnerable public-facing devices and services to gain access to victim environments.(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1068", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has assisted affiliates with gaining privilege escalation through the use of BYOVD.(Citation: BradyUnit42_TheGentlemen_July2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1657", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has used double-extortion tactics to sway victims to pay a ransom to include exfiltrating sensitive data, encrypting files, and threatening public release if a payment is not received.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1683", "showSubtechniques": true}, {"techniqueID": "T1683.001", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has utilized branded code and ransom notes.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1683.002", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has leveraged a branded graphic that is placed on the systems desktop wallpaper that symbolizes the association of malicious activity to the group.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has fabricated the version information of payload files to evade detection.(Citation: Sou\u010dekESET_Gentlemen_Jun2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036.001", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has copied digital signatures from legitimate executables in attempts to circumvent detection.(Citation: Sou\u010dekESET_Gentlemen_Jun2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1036.005", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has named [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) payload files to resemble well-known software vendors to include security vendors. [The Gentlemen](https://attack.mitre.org/groups/G1058) has also utilized icons that match impersonated vendors.(Citation: Sou\u010dekESET_Gentlemen_Jun2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027", "showSubtechniques": true}, {"techniqueID": "T1027.002", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has packed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) binaries utilizing either Themida or Enigma to obfuscate the malicious payloads.(Citation: Sou\u010dekESET_Gentlemen_Jun2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588", "showSubtechniques": true}, {"techniqueID": "T1588.002", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has provided a custom EDR killing tool called GentleKiller and other like software that abuse vulnerable drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique to their affiliates that attempts to disable EDR solutions.(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: TrendAI_TheGentlemen_Sept2025)\n\n[The Gentlemen](https://attack.mitre.org/groups/G1058) has obtained tools to include Advanced IP Scanner, the PowerRun utility and Rocket Chat communication tools.(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1219", "showSubtechniques": true}, {"techniqueID": "T1219.002", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has relied on remote access tools, such as AnyDesk, as a means of maintaining access to victim environment.(Citation: TrendAI_TheGentlemen_Sept2025)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1018", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.(Citation: Intel471_TheGentlemen_Aug2026)   ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1078", "comment": "[The Gentlemen](https://attack.mitre.org/groups/G1058) has leveraged compromised user credentials to gain access to victim hosts.(Citation: Intel471_TheGentlemen_Aug2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by The Gentlemen", "color": "#66b1ff"}]}