The Gentlemen

The Gentlemen is a human-operated ransomware-as-a-service operation, also tracked as Storm-2697, that emerged in mid-2025 and rapidly became one of the most active ransomware brands by victim volume in 2026. Multiple reports assess it as having roots in the Qilin ecosystem, including prior activity under the ArmCorp name, before evolving into an independent affiliate program with an unusually aggressive revenue split favoring affiliates. The operation is associated with Russian-speaking operators and follows a double-extortion model that combines data theft with file encryption and public leak-site pressure.

The malware family is notable for cross-platform ransomware development and aggressive enterprise-scale propagation. Its primary Windows encryptor is written in Go and has been described as obfuscated with Garble, while associated variants have also targeted Linux, NAS, BSD, and VMware ESXi environments, including a C-based ESXi locker. The ransomware uses hybrid cryptography based on Curve25519 or X25519 key exchange with XChaCha20 file encryption, commonly applies partial encryption to larger files for speed, and drops a ransom note associated with the operation. Some builds require a password at launch, which appears intended to hinder sandboxing and automated analysis.

A distinguishing feature of The Gentlemen is its worm-like spreading capability. When enabled, the malware can stage itself over SMB, enumerate reachable systems, and attempt numerous remote execution methods per host, including PsExec, scheduled tasks, services, WMI, WinRM, PowerShell remoting, and Group Policy-based deployment. Reporting also describes domain-wide propagation through NETLOGON and malicious GPO changes. This propagation logic, combined with pre-encryption defense weakening on remote hosts, allows a single foothold to escalate into broad network encryption.

The operation consistently demonstrates strong defense-evasion tradecraft. Observed behavior includes disabling Microsoft Defender, adding exclusions, deleting shadow copies, clearing Windows event logs, deleting forensic artifacts, stopping backup, database, virtualization, and security-related processes and services, and optionally wiping free space or self-deleting after execution. The group is also associated with dedicated security-killing tooling, including the GentleKiller framework and other EDR-killer utilities, as well as bring-your-own-vulnerable-driver techniques used to terminate protected security products. At least one intrusion involved suspected zero-day exploitation to disable endpoint defenses.

The Gentlemen’s intrusion lifecycle extends well beyond encryption. Reported operations include exploitation of internet-facing edge infrastructure, brute-force activity, use of stolen or leaked credentials, cooperation with initial access brokers, Active Directory reconnaissance, credential theft, privilege escalation, lateral movement, persistence through scheduled tasks and autoruns, and data exfiltration prior to ransomware deployment. Associated tooling and infrastructure have included custom Go backdoors, proxy malware, remote administration utilities, and common post-exploitation frameworks.

Initial access is most strongly associated with exploitation of exposed perimeter systems rather than phishing-centric delivery. Repeated reporting links the group to exploitation of edge-device vulnerabilities, especially in VPN and firewall appliances, as well as credential abuse against remote access services. The operation has also been linked to brute-force campaigns, NTLM relay-related activity, and use of compromised enterprise credentials and session material obtained from stealer ecosystems.

Victimology indicates broad global targeting across dozens of countries, with recurring impact in manufacturing, business services, technology, healthcare, transportation, financial services, construction, logistics, and other enterprise sectors. Manufacturing is repeatedly highlighted among the most affected sectors, consistent with the group’s focus on organizations where operational disruption increases ransom pressure. The Gentlemen’s combination of cross-platform lockers, rapid propagation, mature affiliate support, and strong anti-defense tradecraft makes it a high-impact ransomware threat to Windows-centric enterprise networks and mixed Windows-Linux-ESXi environments.