Loading threat actor…
The Gentlemen is a financially motivated ransomware-as-a-service operation, also known as Gentleman and tracked as GOLD SHERWOOD and Storm-2697. It supplies ransomware and supporting infrastructure to affiliates and uses double extortion: stealing information before encrypting systems and threatening publication to obtain payment. Its targets span healthcare, education, technology, manufacturing, food production, professional services, government organizations, and defense-related businesses across multiple countries. The operation emerged in 2025 with a platform prepared by hastalamuerte, a former Qilin affiliate who had previously belonged to Phantom Mantis. Its advertised revenue-sharing model allocated 90% of ransom proceeds to affiliates and 10% to the platform. Its Go-based ransomware supports Windows, Linux, NAS, and BSD systems, with a separate encryption engine for VMware ESXi. The Gentlemen has exploited FortiGate vulnerability CVE-2024-55591 for initial access. Recurring intrusion behaviors include rapid privilege escalation, use of legitimate remote-access tools, data theft, and disruption of security and recovery controls. Operators have used vulnerable drivers to terminate security processes, disabled endpoint protection and backup services, and modified Windows Defender settings. Some intrusions progressed from the first identified post-compromise activity to ransomware deployment within 24 hours. The group operates a data-leak site and applies additional pressure through public messaging and victim harassment. Its extortion activity has included unauthorized posts on a victim's social-media account, while branded extortion materials document staged demands and voice-phishing plans. Affiliates have also been associated with a shared AI-assisted intrusion environment used by multiple ransomware partners; a formal alliance with INC Ransomware has not been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
68 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
44 malware families attributed to this actor across reporting.
39 additional families tracked in Mallory.
11 CVEs this actor has used in observed campaigns. 11 of them exploited in the wild.
Члены группы The Gentlemen проникали в чужие сети через уязвимость в FortiGate — CVE-2024-55591.
The Gentlemen’s rumored exploitation of newer vulnerabilities such as CVE-2025-32433 and CVE-2025-33073 likely helped drive its significant increase in attacks from May onward.
The Gentlemen’s rumored exploitation of newer vulnerabilities such as CVE-2025-32433 and CVE-2025-33073 likely helped drive its significant increase in attacks from May onward.
We also observed traces suggesting the exploitation of CVE-2020-1472 (Zerologon) and the vulnerabilities associated with MS17-010.
Privilege Escalation: Immediately scope for and patch the following vulnerabilities known to be exploited: CVE-2025-7771 ( ThrottleStop.sys driver)
6 more CVEs tied to this actor tracked in Mallory.
317 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Affiliates associated with The Gentlemen are linked to the same exposed AI-assisted operational environment as INC affiliates. The strongest group-specific evidence is a branded, four-message extortion package and vishing plan for Leo Schachter Diamonds, which also appeared on The Gentlemen’s leak blog. Researchers assess shared-environment use with moderate-to-high confidence, but a formal alliance with INC with low confidence. A tooling and infrastructure provider supporting multiple ransomware partners is considered the most plausible explanation. Shared tooling and aggregate victim statistics should not be treated as independently established characteristics of every Gentlemen operation.
The Gentlemen is connected to the exposed operational environment through a branded extortion package targeting Leo Schachter Diamonds, which also appeared on the group's leak blog. The package contained four extortion messages and a vishing plan. Investigators assessed shared use of the environment by operators associated with INC and The Gentlemen with moderate-to-high confidence, but assessed a formal dual-brand alliance with low confidence. The broader AI tooling, exploitation activity and aggregate victim statistics belong to the shared affiliate environment and cannot be assigned exclusively to The Gentlemen.
A group operating a ransomware-as-a-service operation, newly added to ATT&CK v20.
Reportedly conducted a ransomware attack against Wellington College International School Bangkok in Thailand. The breach is dated October 16, 2026, with discovery on October 17, 2026. The content provides no technical evidence or details about the ransomware family, initial access, or data stolen.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.