The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.12345678
- MSTI_GentelmenRansomware_May2026
- Intel471_TheGentlemen_Aug2026
- Sophos_TheGentlemen_Sept2026
- SoučekESET_Gentlemen_Jun2026
- CheckPointResearch_TheGentlemen_April2026
- BradyUnit42_TheGentlemen_July2026
- CarveyODonnellWelchHuntress_TheGentlemen_May2026
- TrendAI_TheGentlemen_Sept2025
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1027.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2026 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1018 | Remote System Discovery | — |
| T1027.002 | Software Packing | — |
| T1036 | Masquerading | — |
| T1036.001 | Invalid Code Signature | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1078 | Valid Accounts | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219.002 | Remote Desktop Software | — |
| T1486 | Data Encrypted for Impact | — |
| T1583.001 | Domains | — |
| T1585 | Establish Accounts | — |
| T1585.001 | Social Media Accounts | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
| T1683.001 | Written Content | — |
| T1683.002 | Audio-Visual Content | — |
Aliases
GOLD SHERWOOD · Storm-2697 · The Gentlemen
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.