MITRE ATT&CKsoftware (malware)
S9051 The Gentlemen Ransomware
- Domain
- enterprise
- Platforms
- macOS, Linux, Windows, IaaS, ESXi, Network Devices
- Version
- 1.0
- Created
- 2026-09-22
Description
The Gentlemen Ransomware is a ransomware-as-a-service (RaaS). The Gentlemen Ransomware has been written in Go programming language and has utilized Garble to obfuscate its code to target Windows environments. The Gentlemen Ransomware is capable of executing its’ OS lockers in Windows, Linux, NAS, BSD and ESXi environments. The Gentlemen Ransomware was first observed in mid-2025 as a closed ransomware and shortly later emerged as a RaaS to affiliates in September 2025. The Gentlemen Ransomware has been affiliated with the threat group The Gentlemen.
Related
Uses · MITRE ATT&CK (45)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1686.003 Windows Host Firewall sub-technique
- T1689 Downgrade Attack technique
- T1690 Prevent Command History Logging technique
- T1679 Selective Exclusion technique
- T1680 Local Storage Discovery technique
- T1678 Delay Execution technique
- T1675 ESXi Administration Command technique
- T1059.012 Hypervisor CLI sub-technique
- T1564.012 File/Path Exclusions sub-technique
- T1027.010 Command Obfuscation sub-technique
- T1070.007 Clear Network Connection History and Configurations sub-technique
- T1484.001 Group Policy Modification sub-technique
- T1074.001 Local Data Staging sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1491.001 Internal Defacement sub-technique
- T1561.001 Disk Content Wipe sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1222.001 Windows Permissions sub-technique
- T1070.003 Clear Command History sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1037.004 RC Scripts sub-technique
Referenced by MITRE ATT&CK · uses (1)
- G1058 The Gentlemen group
References
- https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps CarveyODonnellWelchHuntress_TheGentlemen_May2026
- https://research.checkpoint.com/2026/dfir-report-the-gentlemen/ CheckPointResearch_TheGentlemen_April2026
- https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ MSTI_GentelmenRansomware_May2026
- https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware TrendAI_TheGentlemen_Sept2025