Loading story…
A new ransomware group known as Gentlemen has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific --password argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection.
Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting revealed that Gentlemen uses Group Policy Object manipulation and Bring Your Own Vulnerable Driver techniques to disable security tools, move laterally, and evade detection. The disclosures also described its use of X25519 and XChaCha20 encryption, selective file-segment encryption, and the README-GENTLEMEN.txt ransom note.
Following its initial appearance, Gentlemen ransomware spread to medium and large organizations across at least 17 countries in North America, South America, and the Middle East. The campaign affected multiple industries and used double extortion, combining data theft with file encryption.
Gentlemen ransomware was first observed in August 2025. Researchers identified it as a Go-based ransomware family designed for cross-platform attacks and protected by a required password argument for execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Gentlemen ransomware group has rapidly established itself as a significant threat actor since its emergence around July 2025, leveraging a Ransomware-as-a-Service (RaaS) model and advanced dual-extortion tactics. The group has claimed at least 48 victims within a three-month period, utilizing the XChaCha20 encryption algorithm to lock files and exfiltrating sensitive business data to pressure organizations into paying ransoms. Their operations are characterized by a combination of established ransomware techniques and innovative strategies, including the development of their own RaaS platform after experimenting with various affiliate models, which has enabled them to quickly adapt to new attack vectors and maintain persistence against targeted organizations. Threat intelligence reports highlight that The Gentlemen's data leak site is active, and the group has demonstrated a willingness to publish stolen data if ransom demands are not met. Their evolution from testing other ransomware platforms to building a proprietary service underscores their technical sophistication and intent to scale operations. Security professionals are advised to monitor for indicators of compromise related to The Gentlemen and to ensure robust data protection and incident response measures are in place to mitigate the risk posed by this rapidly evolving ransomware group.
Jul 12, 2026
**The Gentlemen**, also tracked as **Storm-2697**, has rapidly expanded into one of the most active ransomware-as-a-service operations, with reporting indicating it has been active since at least July 2025 and may have previously operated as the **ArmCorp** affiliate of **Qilin**. The group uses ransomware variants written in **C** and **Go**, relies on multiple initial access methods, and has developed custom tooling including a Go-based backdoor and the **GentleKiller** framework designed to disable EDR protections. Researchers said the operation formalized its RaaS model around September 2025 and attracted affiliates by offering an unusually high **90%** share of ransom payments. The group’s activity accelerated sharply in 2026, with one cited count attributing **580 claimed victims across 77 countries** through July 7, including **103** in the manufacturing sector, and **117 claimed victims in June alone**. In May 2026, The Gentlemen also partnered with **HasanBroker’s BreachForums** to recruit affiliates, penetration testers, and initial access brokers, while an alleged insider reportedly leaked an internal database the same month. The campaign’s scale has pushed The Gentlemen to the **second-most active RaaS program of 2026 by victim count**, underscoring the need for organizations to prioritize patching exploited vulnerabilities, hardening MFA and EDR defenses, segmenting networks, and ensuring resilient backups.
Jul 15, 2026
Several new ransomware groups and campaigns have emerged, demonstrating increased sophistication and targeting a range of organizations globally. The SafePay group has established itself as a major threat by operating as a centralized, closed ransomware operation, eschewing the typical Ransomware-as-a-Service (RaaS) model. SafePay employs double extortion tactics, exfiltrating sensitive data before encrypting systems, and leverages rapid attack chains that often move from initial access to full encryption within 24 hours. Their methods include exploiting compromised credentials, misconfigured firewalls, and deploying backdoors for persistence, with a focus on operational security to avoid law enforcement detection. Other notable threats include the CrazyHunter ransomware, which has aggressively targeted healthcare organizations in Taiwan using advanced evasion techniques and multi-stage attacks that exploit Active Directory and propagate via Group Policy Objects. Meanwhile, the Ransomhouse group, operated by Jolly Scorpius, has upgraded its capabilities with a dual-key encryption system and automated attacks on VMware ESXi hypervisors, particularly focusing on German enterprises. These campaigns highlight a trend toward more targeted, technically advanced ransomware operations that prioritize both data theft and rapid system disruption, posing significant risks to critical infrastructure and sensitive industries.
Jun 29, 2026