Loading malware…
Gentlemen is a cross-platform ransomware family and ransomware-as-a-service operation that emerged in 2025 and rapidly became active against medium and large enterprises worldwide. It has been associated with financially motivated intrusions across multiple sectors, including healthcare, manufacturing, insurance, transportation, education, and energy, and has affected organizations in numerous countries. The malware is primarily implemented in Go for broad platform coverage, with reporting also describing a distinct ESXi-focused variant. Gentlemen supports Windows, Linux, NAS-oriented Unix-like environments, BSD, and ESXi, enabling operators and affiliates to target mixed enterprise estates.
Gentlemen is used in double-extortion attacks that combine data theft with file encryption and threats to publish stolen information. Reported intrusion activity includes use of compromised credentials and access to internet-exposed services, followed by extensive internal reconnaissance, credential validation, privilege escalation, and domain-wide deployment. Operators have been observed abusing Group Policy for broad execution and using built-in spreading functionality to propagate across reachable systems and shares. Reporting also links Gentlemen intrusions with remote execution through common administrative mechanisms and with affiliate use of post-exploitation tooling such as Cobalt Strike, Mimikatz, and SystemBC.
The ransomware is notable for aggressive pre-encryption defense evasion. It has been reported to disable Microsoft Defender protections, add exclusions, delete shadow copies, clear event logs, remove PowerShell history, and terminate enterprise applications and security tooling to maximize encryption coverage and hinder response. Gentlemen has also been associated with bring-your-own-vulnerable-driver techniques, including use of a kernel driver to terminate large numbers of security-related processes and interfere with defensive visibility before encryption. Additional operator options support silent encryption behavior, free-space wiping, self-deletion, and printer-based ransom note delivery.
Encryption behavior is optimized for speed and scale. Gentlemen uses a hybrid cryptographic design reported as based on X25519 or Curve25519 key exchange with XChaCha20 for file encryption, generating per-file key material and selectively encrypting portions of larger files while fully encrypting smaller ones. Variants support targeting local disks, network shares, block devices, and virtualized environments; the ESXi-focused functionality includes actions to facilitate encryption of virtual machine storage. The malware leaves ransom notes and has been tied to worm-like propagation when specific spread options are enabled.
Gentlemen has been tracked under the actor designation Storm-2697 and has been described as recruiting affiliates through underground forums. Public reporting indicates the operation evolved quickly, expanded its victim count at pace, and adapted its tooling in response to defender actions, reflecting a mature and fast-moving ransomware ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft Threat Intelligence recently uncovered a dangerous global cyber security operation. Specifically, security researchers are tracking the rapidly growing Gentlemen ransomware threat across multiple continents. This sophisticated platform functions as a ransomware-as-a-service model for financially motivated cybercriminals.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware operation that disables security software prior to encryption, reportedly using a kernel-level driver to terminate nearly 180 security-related processes and evade defenses before locking files.
A ransomware operation that disables security software before encrypting files, reportedly using a kernel-level driver to terminate nearly 180 security-related processes and evade defenses.
Cross-platform ransomware/locker with Windows, Linux, ESXi, old Windows, and LVM-targeting variants. It supports partial encryption speed modes, delayed execution, optional self-delete suppression, free-space wiping, printer note printing, network share encryption, SYSTEM-context execution, lateral movement via credentials, and GPO-based domain-wide deployment.
Gentlemen is a ransomware-as-a-service platform used for double-extortion attacks. It encrypts files, exfiltrates data for extortion, disables Microsoft Defender protections, deletes shadow copies and logs, terminates enterprise applications and EDR processes, uses Curve25519 and XChaCha20 for encryption, appends the .umc16h extension to encrypted files, supports partial encryption modes for speed, and can self-propagate as a worm via network shares and remote execution methods such as PsExec, WMIC, and PowerShell.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.