The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.12345678
- MSTI_GentelmenRansomware_May2026
- Intel471_TheGentlemen_Aug2026
- Sophos_TheGentlemen_Sept2026
- SoučekESET_Gentlemen_Jun2026
- CheckPointResearch_TheGentlemen_April2026
- BradyUnit42_TheGentlemen_July2026
- CarveyODonnellWelchHuntress_TheGentlemen_May2026
- TrendAI_TheGentlemen_Sept2025
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | The Gentlemen | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Storm-2697 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | GOLD SHERWOOD | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2026 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1018 | Remote System Discovery | — |
| T1027.002 | Software Packing | — |
| T1036 | Masquerading | — |
| T1036.001 | Invalid Code Signature | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1078 | Valid Accounts | — |
| T1190 | Exploit Public-Facing Application | — |
| T1219.002 | Remote Desktop Software | — |
| T1486 | Data Encrypted for Impact | — |
| T1583.001 | Domains | — |
| T1585 | Establish Accounts | — |
| T1585.001 | Social Media Accounts | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
| T1683.001 | Written Content | — |
| T1683.002 | Audio-Visual Content | — |
别名
GOLD SHERWOOD · Storm-2697 · The Gentlemen
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。