Gentlemen
Gentlemen is a ransomware family and ransomware-as-a-service operation first observed around mid-2025 to August 2025. It is described as a rapidly growing, financially motivated double-extortion threat that exfiltrates data before encrypting victim systems and threatens public release of stolen information. Reporting links the operation to Microsoft-tracked actor Storm-2697, and multiple sources describe affiliate recruitment on underground forums and partnerships used to expand the ecosystem.
The malware is primarily Go-based and supports cross-platform encryption of Windows, Linux, NAS, and BSD systems, with a separate C-based ESXi locker also described. Available operator documentation shows variants for Windows, Linux, ESXi, legacy Windows (XP+), and Linux LVM/block-device encryption. The locker supports command-line options for targeting local disks, folders, UNC paths, mapped shares, network shares, and block devices; delayed execution; silent mode; self-deletion/retention; free-space wiping; printer-based ransom note deployment; and partial-encryption speed modes such as --fast, --superfast, and --ultrafast. Windows-specific functionality includes SYSTEM-mode execution, lateral movement via supplied domain credentials, and domain-wide deployment through Group Policy. When launched with --spread, reporting says the malware can propagate in a worm-like manner using hidden shares and remote execution methods including PsExec, WMIC, and remote PowerShell.
Gentlemen uses a hybrid cryptographic design based on X25519/Curve25519 and XChaCha20. Sources state it generates per-file ephemeral keys, fully encrypts small files, and partially encrypts larger files in chunks to improve speed. Reported encrypted-file extensions include .umc16h and .7mtzhh. The ransomware requires a --password argument to execute, which is described as an anti-analysis measure. It drops ransom notes named README-GENTLEMEN.txt, and some reporting states it can change the desktop background and offer free decryption of sample files.
Before encryption, Gentlemen is reported to disable Microsoft Defender protections, add exclusions, terminate security, backup, database, virtualization, and email-related processes, delete Volume Shadow Copies, clear Security and System event logs, and remove PowerShell history. Anti-forensic behavior also includes overwriting free disk space using wipefile.tmp and deleting its own binary after execution. Additional reporting describes use of BYOVD techniques to disable defenses.
Observed intrusion tradecraft includes use of compromised credentials and targeting of Internet-exposed services for initial access. Other reporting states intrusions have involved Group Policy modification, encrypted exfiltration with WinSCP, reconnaissance of backups, NAS, Exchange, storage arrays, and virtualization infrastructure, and efforts to obtain domain admin privileges and disable EDR. Leaked internal-chat reporting also mentions use of compromised Fortinet edge-device credentials, OpenConnect, ZeroPulse, living-off-the-land techniques, and an 'EDR Killer' tool. In one investigated intrusion, attackers operated from a Domain Controller with Domain Admin privileges, used Mimikatz, RPC-based deployment of Cobalt Strike, and Group Policy propagation. Check Point also observed a Gentlemen affiliate attempting to deploy SystemBC for covert payload delivery.
Victimology in the provided content indicates targeting of medium and large enterprises across at least 17 countries and sectors including healthcare, manufacturing, insurance, transportation, education, construction, and energy/critical infrastructure. Reported incidents include the December 2025 attack on Romania's state-owned power producer Complexul Energetic Oltenia, which disrupted ERP, email, website, and other business IT systems. The content also states the group had claimed hundreds of victims by 2026 and had become one of the most active emerging ransomware threats of 2025.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft Threat Intelligence recently uncovered a dangerous global cyber security operation. Specifically, security researchers are tracking the rapidly growing Gentlemen ransomware threat across multiple continents. This sophisticated platform functions as a ransomware-as-a-service model for financially motivated cybercriminals.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 technique
Persistence
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Lateral Movement
2 techniques
Lateral Movement
Impact
2 techniques
Impact
IOCs tracked for this family
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cross-platform ransomware/locker with Windows, Linux, ESXi, old Windows, and LVM-targeting variants. It supports partial encryption speed modes, delayed execution, optional self-delete suppression, free-space wiping, printer note printing, network share encryption, SYSTEM-context execution, lateral movement via credentials, and GPO-based domain-wide deployment.
Gentlemen is a ransomware-as-a-service platform used for double-extortion attacks. It encrypts files, exfiltrates data for extortion, disables Microsoft Defender protections, deletes shadow copies and logs, terminates enterprise applications and EDR processes, uses Curve25519 and XChaCha20 for encryption, appends the .umc16h extension to encrypted files, supports partial encryption modes for speed, and can self-propagate as a worm via network shares and remote execution methods such as PsExec, WMIC, and PowerShell.
A Go-based ransomware family operated as a ransomware-as-a-service platform. It is used for large-scale enterprise intrusions, data theft, silent encryption, and data-only extortion across Windows, Linux, NAS, BSD, and ESXi environments. The operators conduct reconnaissance, target backup and virtualization infrastructure, disable security tools, and prepare environments before network-wide encryption.
Gentlemen is a ransomware-as-a-service operation that provides cross-platform lockers for Windows, Linux, NAS, BSD, and ESXi. It uses a hybrid encryption scheme based on X25519 and XChaCha20, supports broad enterprise encryption via GPO propagation, and terminates databases, backup, and virtualization processes before encryption.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.