Home / Ransomware Intelligence / All groups / thegentlemen

thegentlemen Ransomware

🔔 Create alert

Also known as: Storm-2697 · Tracked since Sep 9, 2025

victims recorded

in the last 30 days

CVEs

—

Last activity

In MITRE ATT&CK MITRE ATT&CK

Group profile: The Gentlemen (G1058)

Ransomware cataloged as The Gentlemen Ransomware (S9051)

Used by: The Gentlemen G1058

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1078.002 Valid Accounts: Domain Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1566 Phishing

Execution

T1047 Windows Management Instrumentation T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1072 Software Deployment Tools

Persistence

T1136 Create Account T1543 Create or Modify System Process T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation T1187 Forced Authentication T1557 Adversary-in-the-Middle

Defense Evasion

T1027 Obfuscated Files or Information T1070 Indicator Removal T1090 Proxy T1112 Modify Registry T1484.001 Domain Policy Modification: Group Policy Modification T1562 Impair Defenses T1562.001 Impair Defenses: Disable or Modify Tools

Credential Access

T1003 OS Credential Dumping T1110 Brute Force T1552 Unsecured Credentials T1555 Credentials from Password Stores

Discovery

T1018 Remote System Discovery T1046 Network Service Discovery T1069 Permission Groups Discovery T1087 Account Discovery T1087.002 Account Discovery: Domain Account T1482 Domain Trust Discovery T1526 Cloud Service Discovery

Lateral Movement

T1021 Remote Services T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1021.004 Remote Services: SSH T1563 Remote Service Session Hijacking

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1074 Data Staged T1074.001 Data Staged: Local Data Staging T1114 Email Collection

Exfiltration

T1048 Exfiltration Over Alternative Protocol T1048.001 Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1537 Transfer Data to Cloud Account

Command and Control

T1071 Application Layer Protocol T1071.001 Application Layer Protocol: Web Protocols T1219 Remote Access Software T1572 Protocol Tunneling T1573 Encrypted Channel

Impact

T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491 Defacement

Observed tools

Credential Theft

DumpBrowserSecrets · Hydra · KslDump · KslKatz · XenAllPasswordPro

Defense Evasion

EDRStartupHinder · GFreeze · GLinker

Discovery Enum

ADFind · BloodHound · Censys · CertiHound · MANSPIDER · PowerZure · Shodan · gogo scanner · ldapdomaindump

Exfiltration

rclone

Networking

Chisel-ng · ProxyChains · Tor / Onion C2 · openconnect

Offsec

Custom Go Locker (Windows/Linux/NAS) · NetExec (nxc) · PetitPotam · PrivHound · RegPwn · RelayKing · Responder · TrustedSec Titanis · Velociraptor · ZeroPulse · ntlmrelayx

RMM-Tools

AnyDesk

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live