The Gentlemen
MITRE ATT&CK: G1058 View on attack.mitre.org
Aliases: The Gentlemen, Storm-2697, GOLD SHERWOOD
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Related IoCs
- 48 (40 malicious)
- Last IoC activity
- 2026-10-15 03:14:31
- Profile updated
- 2026-10-15 03:00:04
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Targeted regions: country_code:cn country_code:jp country_code:au
Context
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)
Recent IoC activity
40 malicious indicators in Maltiverse are attributed to The Gentlemen (G1058). The 20 most recently updated:
Malware & tools used
Reports & references
- socradar.io — Dark Web Profile The Gentlemen Ransomware (report)
- Trend Micro — Unmasking The Gentlemen Ransomware (report)
- cybereason.com — The Gentlemen Ransomware (report)
- sprocketsecurity.com — Tracing A Threat Actors Footprints On Tor (report)
- MITRE ATT&CK — G1058 (report)
- research.checkpoint.com — Dfir Report The Gentlemen (report)
- Palo Alto Unit 42 — The Gentlemen Ransomware (report)
- huntress.com — The Gentlemen Ransomware Defense Evasion Ttps (report)
- intel471.com — Threat Hunting Case Study The Gentlemen (report)
- Microsoft — The Gentlemen Ransomware Dissecting A Self Propagating Go Encryptor (report)
- sophos.com — Ungentlemanly Behavior Insights Into A Ransomware Operation (report)
- trendaisecurity.com — Unmasking The Gentlemen Ransomware (report)
- ESET — Killing Me Gently Inside Gentlemens Edr Killer Framework (report)