The Gentlemen is a ransomware-as-a-service operation that went from a closed crew in mid-2025 to one of the two busiest extortion brands of 2026, with 889 victims listed on its leak site as of September 26, 2026, according to ransomware.live. Its affiliates usually break in through FortiGate and other edge devices, then spread with stolen domain credentials, Group Policy, and an encryptor that can copy itself to every reachable Windows host. Nearly every stage leaves clear evidence in logs most teams already collect.
Who The Gentlemen are and how the operation works
Microsoft tracks the operators as Storm-2697. It says the group began as a closed ransomware crew around mid-2025 and opened its platform to affiliates in September 2025 (Microsoft). Group-IB puts the core team at roughly 20 members led by an administrator using the handle hastalamuerte (Group-IB). In June 2026, Brian Krebs publicly named a 36-year-old man in Izhevsk, Russia, as the alleged administrator (KrebsOnSecurity).
The business model is double extortion with an unusually generous split. Affiliates keep 90% of each ransom and the operator takes 10%, according to Check Point’s analysis of the group’s leaked internal data. Stolen files go to the leak site when a victim refuses to negotiate (LevelBlue SpiderLabs).
That leak is a gift to defenders. In May 2026, the crew’s internal chat server was dumped, exposing messages from November 7, 2025 to April 30, 2026 (KELA). It shows members assigned to scanning Fortinet VPNs, using stealer logs to get into OWA and Microsoft 365, buying access from brokers, and sharing a common kit of Active Directory attack tools (Check Point).
How big The Gentlemen is now
When The Hacker News covered the group in June 2026, ransomware.live counted 478 claimed victims. That figure has nearly doubled since. Other trackers show the same growth from different angles:
- Unit 42 counted 580 claimed victims in 77 countries through July 7, 2026, with a record 117 in June alone (Unit 42).
- NCC Group attributed 10% of global ransomware attacks in April 2026 to the group (NCC Group), rising to 15% in July (NCC Group). In August, Qilin took back the top spot (NCC Group).
- ZeroFox ranked it the most prominent extortion collective of July 2026, with at least 120 incidents (ZeroFox).
- Comparitech counted 675 claimed attacks from September 2025 through July 2026, of which only 72 were confirmed (Comparitech).
Treat these as claims, not confirmed breaches, since trackers count differently. The trend is still clear. By ransomware.live’s count, manufacturing is the most hit sector (179 victims) and the United States the most hit country (159). The June spike landed in a month that was rough across the board.
There is no CISA and FBI #StopRansomware advisory on this group yet. The closest formal guidance is CI-ISAC Australia’s advisory from August 28, 2026, plus CISA’s June 18, 2026 alert on hardening Fortinet devices, which covers the door this group uses most.
The Gentlemen ransomware TTPs, stage by stage
Technique IDs follow ATT&CK v19, which moved several defense evasion techniques to new IDs such as T1685. Older reports use T1562.001 and T1070.001 for the same behavior.
Initial access through edge devices
Fortinet is the main door. Group-IB found the operators holding a list of about 14,700 already exploited FortiGate devices and 969 working VPN credentials obtained by brute force, with CVE-2024-55591, a FortiOS and FortiProxy authentication bypass, as their main exploit. Trend Micro’s first write-up in September 2025 also traced entry to an internet-facing FortiGate (Trend Micro). The leaked chats also show the crew weighing an Erlang/OTP SSH bug (CVE-2025-32433) and a Windows SMB flaw (CVE-2025-33073) (Check Point). Stolen passwords also work: both cases Huntress investigated started with RDP logins on compromised accounts.
Foothold, credentials, and evasion
Affiliates map the network with Advanced IP Scanner and Nmap (Trend Micro), then keep access through SystemBC proxies, AnyDesk, or Cobalt Strike. In one Check Point incident, Mimikatz output recovered from memory showed domain credentials, and Cobalt Strike reached new hosts through executables written to ADMIN$ shares.
Before detonation they blind the endpoint. Trend Micro saw a signed driver, ThrottleBlood.sys, used to kill security processes from the kernel, and Unit 42 lists the related ThrottleStop.sys flaw, CVE-2025-7771, among bugs to patch. Huntress saw PowerShell turning off Defender real-time monitoring, excluding the entire C:\ drive, and then clearing the Security, System, and Application logs. Data leaves through renamed Rclone binaries over SFTP, per Group-IB.
The worm-like spread
This is what sets the group apart. Microsoft’s analysis shows that the --spread argument takes a domain username and password and turns the Go encryptor into a worm. For each reachable host it tries 21 remote execution methods, including C$ copies, PsExec, WMIC, scheduled tasks, services, and PowerShell remoting. Before pushing the payload, it disables Defender and the firewall on the target and enables SMB1.
Affiliates who hold Domain Admin often use Group Policy instead. Check Point documented the encryptor copied to NETLOGON, a ScheduledTasks.xml file planted in a new GPO to run a task called SystemUpdate as SYSTEM, and a forced policy refresh across the domain.
Impact
The locker deletes shadow copies, stops database, backup, and virtualization services, and encrypts with XChaCha20 and Curve25519. An optional --wipe flag then overwrites free disk space to block forensic recovery (Microsoft). A separate ESXi locker powers off virtual machines with vim-cmd and force-kills stragglers with esxcli (Rubrik Zero Labs).
Ransomware detection opportunities for each stage
| Stage | ATT&CK | What to alert on |
|---|---|---|
| Initial access | T1190, T1133, T1110 | FortiGate admin logins from new IPs, new firewall admin accounts, bursts of failed SSL VPN logins |
| Valid accounts | T1078, T1021.001 | RDP logons (4624 type 10) to servers from VPN addresses at unusual hours |
| Credential access | T1003.001, T1557.001 | Non-system processes reading LSASS; NTLM authentication from unexpected hosts |
| Remote access | T1090, T1219.002 | AnyDesk installs outside change windows; long-lived outbound proxy connections to rare IPs |
| Defense evasion | T1068, T1685, T1685.005, T1686 | New kernel driver loads; Defender events 5001 and 5007; Add-MpPreference in PowerShell logs; log clears (1102, 104); firewall disabled |
| Exfiltration | T1048 | Rclone or WinSCP running from ProgramData or user folders; large outbound SFTP transfers |
| Worm spread | T1570, T1021.002, T1047, T1053.005, T1569.002, T1021.006 | Bursts of 4698 (task created) and 7045 (service installed) across many hosts; a new hidden share named share$; command lines containing --spread |
| GPO deployment | T1484.001 | 5136 changes to Group Policy objects; new ScheduledTasks.xml in SYSVOL; executables written to NETLOGON |
| Impact | T1490, T1489, T1486 | Shadow copy deletion; mass service stops; README-GENTLEMEN.txt appearing in many folders; esxcli vm process kill on ESXi |
Three signals deserve an immediate page: log clearing, Defender tampering, and GPO edits that add scheduled tasks. Legitimate admins rarely do any of them in production, and Huntress calls log clearing an immediate escalation trigger.
Detect behavior, not names. Microsoft’s sample created tasks named DefU and UpdateGU, while Check Point’s case used UpdateSystem and DefS. File extensions changed from build to build. The ransom note name README-GENTLEMEN.txt has stayed stable across reports, so it works as a late but reliable tripwire.
Correlation turns noise into an incident. One 4698 event is routine. Two hundred across a subnet, minutes after a Defender exclusion by the same account, is the worm running. That grouping is the core job of an AI SOC.
How to defend against The Gentlemen
- Patch and lock down edge devices. Fix CVE-2024-55591, which has been in CISA’s Known Exploited Vulnerabilities catalog since January 14, 2025. Take firewall management off the internet, reset VPN and admin passwords, and require phishing-resistant MFA, as CISA’s Fortinet alert advises.
- Hunt for existing footholds. Given Group-IB’s 14,700 figure, assume your FortiGate may already be compromised. Review admin accounts, configs, and VPN sessions, and sweep endpoints for SystemBC, AnyDesk, and Cobalt Strike.
- Guard domain controllers and Group Policy. Alert on every GPO change, limit who can edit GPOs, and watch NETLOGON and SYSVOL for new executables.
- Break the worm’s paths. Microsoft recommends restricting SMB, WMI, and WinRM to authorized admin sources and enabling the attack surface reduction rule that blocks process creation from PsExec and WMI. Disable SMB1, require SMB signing, and patch CVE-2025-33073.
- Harden endpoints against tampering. Turn on tamper protection, enable Microsoft’s vulnerable driver blocklist, and treat any whole-drive Defender exclusion as an incident.
- Isolate ESXi. Keep SSH off except during maintenance windows and put management interfaces on a dedicated VLAN, as Unit 42 advises.
- Keep offline, immutable backups and test restores. The locker stops Veeam, Acronis, and Backup Exec services by name.
- Test the detections. Run a ransomware scenario with lateral movement and confirm each alert in the table fires.
If you catch it mid-attack, disable the account whose credentials follow --spread in the command line, since that is how the worm authenticates. Block SMB, WMI, and WinRM between workstations, isolate hosts showing mass task or service creation, and remove rogue GPOs before the next refresh.
Where Jutsu fits: Exposure gives you an outside-in view of your internet-facing footprint from public signals. Red Team runs MITRE ATT&CK-mapped scenarios, including ransomware and lateral movement, against authorized targets and measures what your SIEM caught. AgentSOC correlates related alerts into incidents and can isolate hosts or disable users through playbooks, with uncertain cases escalated to an analyst.