Loading story…
The Gentlemen, also tracked as Storm-2697, has rapidly expanded into one of the most active ransomware-as-a-service operations, with reporting indicating it has been active since at least July 2025 and may have previously operated as the ArmCorp affiliate of Qilin. The group uses ransomware variants written in C and Go, relies on multiple initial access methods, and has developed custom tooling including a Go-based backdoor and the GentleKiller framework designed to disable EDR protections. Researchers said the operation formalized its RaaS model around September 2025 and attracted affiliates by offering an unusually high 90% share of ransom payments.
The group’s activity accelerated sharply in 2026, with one cited count attributing 580 claimed victims across 77 countries through July 7, including 103 in the manufacturing sector, and 117 claimed victims in June alone. In May 2026, The Gentlemen also partnered with HasanBroker’s BreachForums to recruit affiliates, penetration testers, and initial access brokers, while an alleged insider reportedly leaked an internal database the same month. The campaign’s scale has pushed The Gentlemen to the second-most active RaaS program of 2026 by victim count, underscoring the need for organizations to prioritize patching exploited vulnerabilities, hardening MFA and EDR defenses, segmenting networks, and ensuring resilient backups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The group's claimed victim volume surged in 2026, with June 2026 identified as its peak month at 117 claimed victims.
Unit 42 reports that an alleged insider leaked an internal database belonging to The Gentlemen during May 2026.
In May 2026, The Gentlemen partnered with HasanBroker's BreachForums to recruit affiliates, penetration testers, and initial access brokers.
Reporting cited by Unit 42 says the group transitioned into a formal ransomware-as-a-service operation around September 2025. The program reportedly offered affiliates a 90% share of ransom payments.
Unit 42 says The Gentlemen ransomware operation, also tracked as Storm-2697, has been active since at least July 2025 and likely previously operated as the ArmCorp affiliate of Qilin.
A source cited by Unit 42 counted 580 claimed victims through July 7, 2026, spanning 77 countries, including 103 in manufacturing. The report says this made The Gentlemen the second most active RaaS program of 2026 by victim count.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Gentlemen ransomware group has rapidly established itself as a significant threat actor since its emergence around July 2025, leveraging a Ransomware-as-a-Service (RaaS) model and advanced dual-extortion tactics. The group has claimed at least 48 victims within a three-month period, utilizing the XChaCha20 encryption algorithm to lock files and exfiltrating sensitive business data to pressure organizations into paying ransoms. Their operations are characterized by a combination of established ransomware techniques and innovative strategies, including the development of their own RaaS platform after experimenting with various affiliate models, which has enabled them to quickly adapt to new attack vectors and maintain persistence against targeted organizations. Threat intelligence reports highlight that The Gentlemen's data leak site is active, and the group has demonstrated a willingness to publish stolen data if ransom demands are not met. Their evolution from testing other ransomware platforms to building a proprietary service underscores their technical sophistication and intent to scale operations. Security professionals are advised to monitor for indicators of compromise related to The Gentlemen and to ensure robust data protection and incident response measures are in place to mitigate the risk posed by this rapidly evolving ransomware group.
Jul 12, 2026
A new ransomware group known as **Gentlemen** has launched a series of attacks targeting organizations in at least 17 countries, employing a double extortion model that involves both data exfiltration and encryption. The ransomware, developed in the Go programming language, leverages advanced techniques such as Group Policy Object (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD) tactics to disable security defenses and propagate laterally within corporate networks. Industries affected include healthcare, manufacturing, and insurance, with the group specifically focusing on medium to large enterprises. The malware requires a specific `--password` argument to execute, serving as an anti-analysis measure, and offers operators various command-line options to control its behavior and evade detection. Analysts have identified Gentlemen as one of the most active emerging ransomware threats of 2025, with rapid expansion across North America, South America, and the Middle East. The group’s sophisticated evasion and propagation methods, combined with its aggressive targeting of sensitive data, underscore the urgent need for enhanced monitoring and defensive measures in enterprise environments. The campaign’s use of double extortion ensures that even organizations with robust backup strategies remain vulnerable to data leaks and reputational damage if ransoms are not paid.
Jun 29, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Jul 21, 2026