The Gentlemen

The Gentlemen is a rapidly growing ransomware-as-a-service operation, also tracked as Storm-2697, that emerged in mid-2025 after operators associated with the Qilin ecosystem split off and launched an independent program. It has become one of the most active ransomware brands globally through aggressive affiliate recruitment, unusually favorable revenue sharing, and a packaged intrusion workflow that lowers the barrier for affiliates. The operation is widely associated with the actor alias hastalamuerte and has been linked in public reporting to the former ArmCorp affiliate crew.

The malware family is notable for cross-platform ransomware capability and aggressive propagation. Its primary Windows encryptor is written in Go and obfuscated, while additional variants have been reported in C for other environments including ESXi. The ransomware targets Windows, Linux, NAS, BSD, and ESXi environments, uses hybrid public-key and symmetric cryptography, and supports partial encryption for speed on large files. It commonly combines encryption with data theft for double extortion and can deploy across a domain using Group Policy abuse, administrative shares, PsExec, PowerShell remoting, WMI, WinRM, scheduled tasks, and related remote execution methods. A standout feature is a worm-like spread mode that can recursively propagate from a single foothold across reachable network systems.

The Gentlemen’s operators and affiliates typically prioritize enterprise intrusions over mass phishing. Reported initial access methods include exploitation of internet-facing edge infrastructure such as VPNs, firewalls, and other perimeter devices, brute-force attacks, use of stolen or leaked credentials, and cooperation with initial access brokers. Public reporting also links the operation to inventories of pre-compromised edge devices and to exploitation or active tracking of multiple high-profile vulnerabilities affecting enterprise access infrastructure and Windows environments.

Post-compromise behavior includes Active Directory reconnaissance, credential theft, privilege escalation, lateral movement, exfiltration, and broad defense evasion. The operation has used custom backdoors, proxy malware, remote administration tools, and commodity offensive tooling to maintain access and stage ransomware. It is especially notable for repeated use of EDR- and AV-killing frameworks, including bring-your-own-vulnerable-driver techniques to terminate protected security products at kernel level. Additional anti-recovery and anti-forensics behavior includes disabling Microsoft Defender, stopping backup, database, virtualization, and security services, deleting shadow copies, clearing Windows event logs, wiping free space in some modes, and self-deleting after execution. Persistence has been observed via scheduled tasks, registry autoruns, and remote access tooling.

Victimology indicates broad global targeting across dozens of countries, with recurring impact in manufacturing, professional and business services, technology, healthcare, transportation, financial services, construction, logistics, and other enterprise sectors. The operation appears opportunistic but strongly enterprise-focused, with emphasis on organizations where operational disruption increases payment pressure. Like many Russian-speaking ransomware operations, it has been reported to avoid targeting CIS entities.

The Gentlemen is best understood as a mature, human-operated RaaS platform that integrates proven ransomware tradecraft, cross-platform lockers, strong affiliate support, double extortion, and unusually aggressive self-propagation into a fast-scaling extortion ecosystem.