MITRE ATT&CKgroup
G1058 The Gentlemen
- Domain
- enterprise
- Aliases
- Storm-2697, GOLD SHERWOOD
- Version
- 1.0
- Created
- 2026-09-18
Description
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.
Related
Uses · MITRE ATT&CK (20)
- S9051 The Gentlemen Ransomware software (malware)
- T1683.001 Written Content sub-technique
- T1683.002 Audio-Visual Content sub-technique
- T1219.002 Remote Desktop Software sub-technique
- T1657 Financial Theft technique
- S0645 Wevtutil software (tool)
- T1585 Establish Accounts technique
- T1585.001 Social Media Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1036.001 Invalid Code Signature sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1486 Data Encrypted for Impact technique
- T1190 Exploit Public-Facing Application technique
- S0029 PsExec software (tool)
- T1018 Remote System Discovery technique
- T1036 Masquerading technique
- T1068 Exploitation for Privilege Escalation technique
- T1078 Valid Accounts technique
References
- https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/ BradyUnit42_TheGentlemen_July2026
- https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps CarveyODonnellWelchHuntress_TheGentlemen_May2026
- https://research.checkpoint.com/2026/dfir-report-the-gentlemen/ CheckPointResearch_TheGentlemen_April2026
- https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen Intel471_TheGentlemen_Aug2026
- https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ MSTI_GentelmenRansomware_May2026
- https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware TrendAI_TheGentlemen_Sept2025
- https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation Sophos_TheGentlemen_Sept2026
- https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/ SoučekESET_Gentlemen_Jun2026