Loading malware…
Gentlemen is a cross-platform ransomware family associated with a financially motivated ransomware-as-a-service operation that emerged in mid-2025. Its operators are tracked by Microsoft as Storm-2697 and by Sophos as GOLD SHERWOOD. The operation conducts double-extortion attacks, stealing sensitive information before encrypting systems and threatening public disclosure. Targets include medium and large organizations worldwide across healthcare, manufacturing, insurance, transportation, education, and energy. The family includes Go-based lockers for Windows and Linux and a C-based locker for VMware ESXi, with additional support for BSD and network-attached storage environments.
Gentlemen uses X25519 key agreement and XChaCha20 file encryption, generating fresh cryptographic material for individual files. It fully encrypts small files and selectively encrypts portions of larger files to accelerate deployment. Its execution requires a password argument, limiting unintended execution and hindering analysis. Windows variants can encrypt local volumes and network shares, propagate using supplied domain credentials, and support domain-wide deployment through Group Policy. Remote execution mechanisms include PsExec, Windows Management Instrumentation, and PowerShell. ESXi variants stop virtual machines before encrypting their disks, while a Linux variant targets logical-volume block devices.
Before encryption, Gentlemen disables Microsoft Defender protections, terminates endpoint-security, database, backup, and virtualization processes, deletes shadow copies, and clears logs. Optional behaviors include preserving file names and timestamps, overwriting free disk space, and deleting the encryptor after execution. Affiliates also use vulnerable drivers and kernel-level tooling to impair endpoint defenses. Observed intrusion methods include stolen VPN credentials and exploitation of exposed or vulnerable firewall infrastructure. Attackers conduct credential harvesting and reconnaissance, obtain privileged access, move laterally using legitimate administrative mechanisms, and exfiltrate data with file-transfer and object-storage utilities. Associated intrusions have used tools such as Mimikatz, Cobalt Strike, Rclone, and WinSCP. Network-wide encryption can follow the first observed post-compromise activity in less than 24 hours.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The recovered files linked the activity to the Gentlemen cluster. The attribution is an assessment, but the shared tooling, installer naming, and infrastructure provide strong context for defenders investigating related incidents.
Azazel was operating as an affiliate of the Gentlemen ransomware group using their tooling, negotiation channels, and ransom note template.
The Gentlemen ransomware operation is moving from access to full network encryption at striking speed... Its double-extortion approach adds pressure: files are stolen first, then encrypted.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
--gpo Deploy via Group Policy to all domain computers (run on DC) ... --spread "domain.com\user:pass"
--keep Do not selfdelete after encryption
--gpo Deploy via Group Policy to all domain computers (run on DC) ... --spread "domain.com\user:pass"
--gpo Deploy via Group Policy to all domain computers (run on DC) ... --spread "domain.com\user:pass"
--shares Crypt only mapped network drives and available network shares (session context) ... --spread Run lateral movement ... --gpo Deploy via Group Policy to all domain computers
--spread Run lateral movement: --spread "domain.com\user:pass" or " " for current session ... --gpo Deploy via Group Policy to all domain computers (run on DC)
If not specified, encrypts all available drives ... --shares Crypt only mapped network drives and available network shares ... --full Two-phase: --system + --shares ... Linux/ESXi/LVM versions target directories, VM storage, and block devices for encryption.
--wipe Wipe free disk space after encryption. Use only if you delete something before lock
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation whose infrastructure and tooling Azazel used to compromise organisations and conduct extortion. The affiliate harvested CI/CD secrets, exfiltrated data, and published victims through his independent LEAKNED site while allegedly withholding proceeds from the Gentlemen operator. The report documents production database destruction in one engagement but does not establish ransomware encryption in the described attacks.
Ransomware operation that claimed responsibility for stealing Veradigm patient records and publishing Veradigm on its leak site. The group has conducted hundreds of attacks since emerging in the prior fall and reportedly also targeted Nutex and AnMed.
A double-extortion ransomware operation whose affiliates obtain access through exposed or unpatched remote infrastructure and stolen VPN credentials, disable EDR/antivirus and backup services, exfiltrate selected data, and rapidly encrypt Windows environments. The locker can be deployed locally, via network shares, or domain-wide through centralized logon shares and remote execution; related builds support Linux and ESXi.
A Go-based ransomware-as-a-service operation employing a double-extortion model. Affiliates obtain access through stolen VPN credentials and vulnerable firewalls, then use RDP, Cloudflared tunnels, credential dumping, Rclone exfiltration, BYOVD-based EDR-disabling tooling, and backup tampering before encrypting victim environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.