Home / Threat actors / The Gentlemen

The Gentlemen G1058

🔔 Create alert

Also known as: Storm-2697, GOLD SHERWOOD

Updated at source on Sep 30, 2026 · View on MITRE ATT&CK

0

associated CVEs

20

Techniques

3

Malware and tools

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.

Ransomware operations linked to this group ransomware.live

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.001 Domains T1585 Establish Accounts T1585.001 Social Media Accounts T1588.002 Tool T1683.001 Written Content T1683.002 Audio-Visual Content

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1068 Exploitation for Privilege Escalation T1078 Valid Accounts

Stealth

T1027.002 Software Packing T1036 Masquerading T1036.001 Invalid Code Signature T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts

Discovery

T1018 Remote System Discovery

Command and Control

T1219.002 Remote Desktop Software

Impact

T1486 Data Encrypted for Impact T1657 Financial Theft

Malware and tools

The Gentlemen RansomwareMalwareS9051
PsExecToolS0029
WevtutilToolS0645

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.