The Gentlemen: Inside One of 2026’s Fastest-Scaling Ransomware Operations

A threat intelligence profile of “The Gentlemen” ransomware-as-a-service group

TL;DR

• Emerged: July 2025, as a splinter faction of Qilin RaaS
• Also tracked as: Storm-2697 (Microsoft)
• Business model: Ransomware-as-a-Service with a 90/10 affiliate revenue split
• Scale: At least 332 published victims since inception (per Check Point, as of June 2026), with 240+ of those posted in 2026 alone, spanning 60+ countries and 20+ industry verticals
• Ranking: Second most active ransomware group by victim count, behind only Qilin
• Core team: Estimated ~20 members, many with prior RaaS experience
• Primary targets: Manufacturing, healthcare, construction, insurance, energy, government, technology
• Entry point of choice: Internet-facing edge devices ,VPNs and firewalls, particularly Fortinet appliances
• Notable trait: Avoids targeting Russia and CIS countries, suggesting Russian-speaking operators

Origins: A Payment Dispute That Birthed a New Threat

The Gentlemen’s origin story is unusually well documented for a ransomware operation. The group’s operators previously ran under the name ArmCorp, functioning as an affiliate of the established Qilin RaaS platform. That relationship fell apart on July 22, 2025, when the affiliate using the handle “hastalamuerte” , publicly accused Qilin’s operators of withholding roughly $48,000 in unpaid commissions, airing the grievance on the RAMP underground forum.

Within days, the first Gentlemen-branded infrastructure appeared. What started as a closed operation targeting select victims transitioned into a full RaaS platform by September 2025, complete with an affiliate panel, a data leak site, and critically an unusually generous 90/10 revenue split in affiliates’ favor, compared to the industry-standard 80/20. That single business decision appears to be the group’s biggest growth lever, pulling experienced operators away from competing programs almost overnight.

By early 2026, The Gentlemen had struck an official recruitment partnership with BreachForums, opening the affiliate program to a much wider pool of penetration testers and initial access brokers, a move likely to accelerate the group’s already unusual growth curve.

Growth Trajectory

The numbers are what set The Gentlemen apart from a typical emerging RaaS brand. In its first five months of activity, the group listed as many victims on its leak site as it took Akira twelve months and Qilin eighteen months to accumulate. More than 200 of its victim postings occurred in the January–March 2026 window alone.

Precise totals vary slightly by vendor and by the date each report was published, which is expected given how fast the leak site has been growing:

• Halcyon (May 2026): ~300 claimed victims across 66+ countries and 20+ industry verticals
• Check Point, via KrebsOnSecurity (June 2026): at least 332 published victims since inception, with 240+ posted in 2026 alone

That puts The Gentlemen second only to Qilin in overall victim volume ahead of long-established names like Cl0p, RansomHub, and LockBit.

Victimology

Reporting from multiple vendors converges on a similar target profile:

• Manufacturing
• Healthcare
• Construction
• Insurance
• Energy
• Government
• Technology

Organizations running Fortinet edge devices and those heavily dependent on Active Directory face elevated risk, since both are central to the group’s intrusion and lateral-movement playbook. Trend Micro’s initial August 2025 analysis put the group’s footprint at 17+ countries; by mid-2026 that had grown to 60+ countries as the group scaled. Throughout, the group has explicitly steered clear of Russia and CIS nationsa pattern that strongly suggests Russian-speaking operators observing an unwritten rule common among CIS-based cybercrime crews.

Technical Analysis: How The Gentlemen Operate

Initial Access

The group favors internet-facing infrastructure, VPN concentrators and firewalls , as its primary entry vector, with a documented preference for exploiting or abusing Fortinet devices. Once a foothold is established, the group moves to full network encryption within hours, reflecting a high degree of operational maturity and pre-planning rather than opportunistic, slow-burn intrusions.

Reconnaissance

Internal reconnaissance relies on a mix of legitimate and dual-use tooling:

• SharpADWS — enumerates Active Directory objects while bypassing conventional LDAP logging by wrapping queries in SOAP messages
• NetScan and Advanced IP Scanner — network and host discovery
• netsh — native Windows utility abused for environment mapping

Lateral Movement and Deployment

The Gentlemen have engineered a genuinely distinctive distribution mechanism: they push the ransomware binary through the NETLOGON share, allowing simultaneous execution across every machine that authenticates to the domain. This is paired with a custom PowerShell script “deploy_gpo.ps1" that leverages Group Policy Objects to distribute and trigger the payload domain-wide. Where GPO-based delivery isn’t feasible, the group falls back on PsExec for remote execution.

Defense Evasion

Evasion is layered and deliberate:

• BYOVD (Bring Your Own Vulnerable Driver) attacks, installing a known-vulnerable signed driver and exploiting it to kill security agents with kernel-level privileges. Beyond BYOVD in general terms, research has identified the specific driver and toolchain in use.
• The group (via its affiliates) deploys ThrottleBlood.sys — a renamed, weaponized version of ThrottleStop.sys, a legitimate CPU thermal-monitoring driver to exploit CVE-2025–7771, a high-severity vulnerability enabling kernel-level code execution. Once loaded, this grants privileges sufficient to terminate protected security software.
• The kernel access is paired with user-mode executables, All.exe and its improved variant Allpatch2.exe, which dynamically detect and stops whichever EDR/AV product is running on the victim system rather than relying on a static kill-list.
• ESET researchers, who named the group’s broader tooling GentleKiller, note this EDR-killer suite also incorporates two other third-party component, HexKiller and HavocKiller and assess with high confidence that Gentlemen did not develop ThrottleBlood in-house; it has also been observed in unrelated MedusaLocker and DragonForce intrusions, and its ultimate origin remains unconfirmed.
• Purpose-built anti-AV utilities, including a tool (kavrmvr.exe) built specifically to uninstall Kaspersky endpoint protection
• Direct registry manipulation to disable Windows Defender’s real-time protection
• Privileged domain account compromise to ensure evasion tooling runs with maximum permissions

The Encryptor

The ransomware payload itself is cross-platform, written in both C and Go, enabling the group to target Windows, Linux, and virtualization infrastructure (e.g., ESXi) from a shared codebase. Microsoft’s analysis specifically highlighted a self-propagating Go variant, indicating the group is actively investing in worm-like spreading capability rather than relying solely on manual lateral movement a sign the toolset is still maturing rather than static.

Extortion Model

The Gentlemen run a standard double-extortion playbook: encrypt files for operational disruption, exfiltrate sensitive data beforehand, and threaten public release on a dark web leak site if the ransom isn’t paid. Victim data is published in stages, with company names and descriptions displayed on the leak site as pressure escalates.

MITRE ATT&CK Mapping (Summary)

Initial Access

• T1190 — Exploit Public-Facing Application: The Gentlemen gain their initial foothold by targeting internet-facing infrastructure, with a strong preference for VPN concentrators and firewalls particularly Fortinet appliances.

Discovery

• T1087.002 — Account Discovery: Domain Account: The group uses SharpADWS to enumerate Active Directory objects while evading conventional LDAP-based logging.
• T1046 — Network Service Discovery: Tools like NetScan and Advanced IP Scanner are used to map live hosts and services across the network.
• T1018 — Remote System Discovery: The native Windows utility netsh is abused to further profile the environment.

Lateral Movement

• T1021.002 — SMB/Windows Admin Shares: The ransomware payload is pushed through the NETLOGON share, allowing near-simultaneous execution across every domain-authenticated machine.
• T1570 — Lateral Tool Transfer: A custom PowerShell script, deploy_gpo.ps1, distributes and triggers the payload domain-wide via Group Policy Objects.
• T1569.002 — System Services: Service Execution: Where GPO-based delivery isn’t feasible, the group falls back on PsExec for remote execution.

Privilege Escalation

• T1078.002 — Valid Accounts: Domain Accounts: Compromised privileged domain accounts are used to ensure evasion tooling and payloads run with maximum permissions.

Defense Evasion

• T1562.001 — Impair Defenses: Disable or Modify Tools: A purpose-built utility (kavrmvr.exe) uninstalls Kaspersky endpoint protection, alongside registry tampering to disable Windows Defender’s real-time protection.
• T1211 — Exploitation for Defense Evasion: The group uses BYOVD (Bring Your Own Vulnerable Driver) attacks, via ThrottleBlood.sys (renamed ThrottleStop.sys), exploiting a signed-but-vulnerable driver to kill security agents at the kernel level.
• T1112 — Modify Registry: Direct registry edits are used to disable Defender protections as part of the broader evasion chain.

Exfiltration

• T1041 — Exfiltration Over C2 Channel: Sensitive data is exfiltrated through an encrypted channel prior to encryption, setting up the double-extortion play.

Impact

• T1486 — Data Encrypted for Impact: The cross-platform C/Go encryptor targets Windows, Linux, and virtualization hosts (e.g., ESXi) from a shared codebase.
• T1489 — Service Stop: Security and backup services are disabled ahead of encryption to maximize damage and prevent recovery.

Known Indicators of Compromise (IOCs)

The indicators below are drawn directly from vendor research and are the ones consistently corroborated across reports. Ransomware IOCs especially file hashes churn quickly as affiliates recompile per campaign, so treat this as a starting point and pull live/updated indicator feeds from the vendor sources before use in production detections.

• File hash (SHA256): 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67 — an encryptor sample associated with Microsoft's ASIM hunting query.
• Ransom note filename: README-GENTLEMEN.txt — dropped on victim hosts post-encryption.
• Encrypted file extension: .7mtzhh (per-victim, randomized) appended to encrypted files; the exact string varies by campaign/build.
• Anti-AV tool: kavrmvr.exe — a purpose-built utility used to uninstall Kaspersky endpoint protection.
• Lateral movement script: deploy_gpo.ps1 — a custom PowerShell script used for GPO-based payload distribution.
• Dual-use tooling: SharpADWS, NetScan, Advanced IP Scanner, and PsExec — legitimate or gray tools abused for reconnaissance and lateral movement; these should be detected via behavior rather than static hash matching alone.
• Detection query (encryptor execution): eventSubId: 106 AND processcmd: /--password\s+(\w{8})\b/ AND objectFilePath: .7mtzhh — a Trend Vision One hunting query for encryptor execution.
• Detection query (ransom note drop): eventSubId: 101 AND processcmd: /--password\s+(\w{8})\b/ AND objectFilePath: README-GENTLEMEN.txt — a Trend Vision One hunting query for ransom note drop.

For a full, continuously updated hash/IP/domain list, pull directly from:

• Trend Micro Vision One Intelligence Reports — *Dressed to Encrypt: The Gentlemen’s Tailored Ransomware Campaign*
• Microsoft Threat Intelligence — *Dissecting a Self-Propagating Go Encryptor* (includes Sentinel/ASIM KQL hunting queries)
• Kaspersky Securelist — *The Gentlemen RaaS: Rapid Growth and a New Ransomware Variant* (SHA256/SHA1 sample hashes)

Why Defenders Should Care

The Gentlemen’s trajectory from a disgruntled Qilin affiliate to the second most prolific ransomware brand in under a year illustrates how quickly a well-funded, technically competent splinter group can outpace established players once it gets the incentive structure right. The 90/10 affiliate split isn’t just a marketing gimmick; it’s functioning as an effective talent-acquisition strategy for experienced ransomware operators.

Recommended Mitigations

• Patch and harden edge devices. Prioritize Fortinet VPN/firewall patching and disable unnecessary exposed management interfaces.
• Monitor NETLOGON and SYSVOL shares for unexpected executable writes or unusual access patterns.
• Audit GPO changes and alert on newly created or modified Group Policy Objects, especially those touching startup/logon scripts.
• Restrict and monitor driver installation to catch BYOVD activity; maintain an updated vulnerable-driver blocklist.
• Enforce tamper protection on EDR/AV to prevent registry-based or utility-based disabling.
• Segment Active Directory privileges and monitor for anomalous use of privileged/service accounts.
• Assume cross-platform exposure — Linux and virtualization hosts (ESXi) are in scope, not just Windows endpoints.

Closing Thoughts

The Gentlemen exemplify a broader shift in the ransomware ecosystem: RaaS “brand loyalty” is thin, and a single pricing decision can trigger a mass migration of skilled affiliates. Expect continued rapid growth, further tooling investment in self-propagating capability, and expanding affiliate recruitment through mainstream cybercrime marketplaces like BreachForums. Organizations in manufacturing, healthcare, energy, and government particularly those running exposed Fortinet infrastructure should treat this group as a near-term, high-priority threat.

Sources

• Trend Micro, *Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed*, September 2025
• FortiGuard Labs, *The Gentlemen Ransomware — Threat Actor Profile*
• Brian Krebs, *Who Runs the Ransomware Group “The Gentlemen”?*, KrebsOnSecurity, June 2026
• SOCRadar, *Dark Web Profile: The Gentlemen Ransomware*, February 2026
• Halcyon, *The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record*, May 2026
• Cybereason, *License to Encrypt: “The Gentlemen” Make Their Move*
• Microsoft Security Blog, *The Gentlemen Ransomware: Dissecting a Self-Propagating Go Encryptor*, May 2026
• Kaspersky Securelist, *The Gentlemen RaaS: Rapid Growth and a New Ransomware Variant*
• Palo Alto Networks Unit 42, *No Manners Here: The Ruthless Rise of The Gentlemen Ransomware*

This report is compiled from open-source threat intelligence for educational and defensive awareness purposes.