Skip to content

The Gentlemen

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.

ATT&CK ID: G1058
Weather family: Storm
Techniques: 13
Tools: 3

Also tracked as Storm-2697 · GOLD SHERWOOD

Techniques

Resource Development

Acquire Infrastructure Establish Accounts Obtain Capabilities Generate Content

Initial Access

Valid Accounts Exploit Public-Facing Application

Persistence

Privilege Escalation

Exploitation for Privilege Escalation Valid Accounts

Stealth

Obfuscated Files or Information Masquerading Valid Accounts

Discovery

Remote System Discovery

Command and Control

Remote Access Tools

Impact

Data Encrypted for Impact Financial Theft

Software

PsExec · The Gentlemen Ransomware · Wevtutil

MITRE ATT&CK All threat actors