The Gentlemen

Also known as Storm-2697, GOLD SHERWOOD

The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption methods based on file size. The group targets medium to large organizations across various sectors, particularly in the Asia-Pacific region, and has demonstrated a high level of technical maturity and operational discipline. Their activities include systematic compromise of enterprise environments, mass account enumeration, and the use of encrypted channels for data exfiltration.

ATT&CK techniques

Recent activity

• Epichealth Medical Clinics Confirms Data Breach Following The Gentlemen Ransomware Claim Epichealth Medical Clinics confirmed a data breach involving unauthoriz
  mastodon · Nov 5, 2026
• 📊 Baromètre cyber France · octobre 2026 🔒 16 victimes françaises de ransom… 🔓 57 fuites de données touchant la France 🔥 36 failles activement exploitées 🚨
  mastodon · Nov 1, 2026
• 🇸🇪 We tracked a ransomware claim by The Gentlemen listing Svedala Kommun, a municipality in Skåne County, Sweden. The Gentlemen has logged 139 listings in the
  mastodon · Oct 30, 2026
• 🏆 New Achievement! Please Hold, Your Encryption Is Very Important to Us! Executing helpdesk impersonation protocol. Objective: gain trust. Sub-objective: disab
  mastodon · Oct 29, 2026
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
  reddit · Oct 28, 2026
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
  reddit · Oct 28, 2026
• ---------------- 🎯 Threat Intelligence: The Gentlemen, a cross-platform RaaS operation with a BYOVD-style EDR killer =================== Acronis' Threat Re
  mastodon · Oct 28, 2026
• Kenaitze Indian Tribe Discloses Data Breach Affecting Over 9,300 Individuals The Kenaitze Indian Tribe disclosed a data breach affecting over 9,300 individuals
  mastodon · Oct 28, 2026
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation https://www. acronis.com/en/tru/posts/the-g entlemen-a-closer-look-at-a-not-so
  mastodon · Oct 27, 2026
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
  reddit · Oct 27, 2026
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
  reddit · Oct 26, 2026
• SOCRadar exposed INC and The Gentlemen ransomware affiliates' AI infrastructure, revealing 8,257 messages and a Phantom framework that turned https:// deafn
  mastodon · Oct 25, 2026
• 🏆 New Achievement! AI-Assisted Arson, Sold Separately! Step right up, step right up — for just $23,920 in AI API fees, The Gentlemen and INC ransomware crew bu
  mastodon · Oct 24, 2026
• 🤖 Group-IB and NyxLab tie a campaign against exposed FortiGate and Palo Alto GlobalProtect edge devices to actor k0t (CryptoFeel, Member19), likely an initial
  mastodon · Oct 23, 2026
• SOCRadar's Exposed Phantom framework reportedly ties AI-assisted intrusions to INC and The Gentlemen ransomware affiliates. AI may be shortening the path fr
  mastodon · Oct 23, 2026

References

• https://socradar.io/blog/dark-web-profile-the-gentlemen-ransomware/
• https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
• https://www.cybereason.com/blog/the-gentlemen-ransomware
• https://www.sprocketsecurity.com/blog/tracing-a-threat-actors-footprints-on-tor
• https://attack.mitre.org/groups/G1058
• https://research.checkpoint.com/2026/dfir-report-the-gentlemen/
• https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/
• https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps
• https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen
• https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/
• https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation
• https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.