Loading story…
The Gentlemen ransomware group has emerged with highly adaptive and targeted campaigns, leveraging custom tools to bypass enterprise security and attack organizations in at least 17 countries. Their operations focus on manufacturing, construction, healthcare, and insurance, with a notable concentration in the Asia-Pacific region. The group employs advanced techniques such as legitimate driver abuse, Group Policy manipulation, and encrypted exfiltration, posing a significant threat to organizations regardless of existing defenses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026
The Gentlemen ransomware group has rapidly established itself as a significant threat actor since its emergence around July 2025, leveraging a Ransomware-as-a-Service (RaaS) model and advanced dual-extortion tactics. The group has claimed at least 48 victims within a three-month period, utilizing the XChaCha20 encryption algorithm to lock files and exfiltrating sensitive business data to pressure organizations into paying ransoms. Their operations are characterized by a combination of established ransomware techniques and innovative strategies, including the development of their own RaaS platform after experimenting with various affiliate models, which has enabled them to quickly adapt to new attack vectors and maintain persistence against targeted organizations. Threat intelligence reports highlight that The Gentlemen's data leak site is active, and the group has demonstrated a willingness to publish stolen data if ransom demands are not met. Their evolution from testing other ransomware platforms to building a proprietary service underscores their technical sophistication and intent to scale operations. Security professionals are advised to monitor for indicators of compromise related to The Gentlemen and to ensure robust data protection and incident response measures are in place to mitigate the risk posed by this rapidly evolving ransomware group.
Aug 15, 2026
**The Gentlemen**, also tracked as **Storm-2697**, has rapidly expanded into one of the most active ransomware-as-a-service operations, with reporting indicating it has been active since at least July 2025 and may have previously operated as the **ArmCorp** affiliate of **Qilin**. The group uses ransomware variants written in **C** and **Go**, relies on multiple initial access methods, and has developed custom tooling including a Go-based backdoor and the **GentleKiller** framework designed to disable EDR protections. Researchers said the operation formalized its RaaS model around September 2025 and attracted affiliates by offering an unusually high **90%** share of ransom payments. The group’s activity accelerated sharply in 2026, with one cited count attributing **580 claimed victims across 77 countries** through July 7, including **103** in the manufacturing sector, and **117 claimed victims in June alone**. In May 2026, The Gentlemen also partnered with **HasanBroker’s BreachForums** to recruit affiliates, penetration testers, and initial access brokers, while an alleged insider reportedly leaked an internal database the same month. The campaign’s scale has pushed The Gentlemen to the **second-most active RaaS program of 2026 by victim count**, underscoring the need for organizations to prioritize patching exploited vulnerabilities, hardening MFA and EDR defenses, segmenting networks, and ensuring resilient backups.
Jul 15, 2026