The Gentlemen

The Gentlemen is a rapidly growing ransomware-as-a-service (RaaS) operation active since at least mid-2025 and tracked by Microsoft as Storm-2697. Multiple reports assess that it emerged from the Qilin ecosystem after a split involving operators previously associated with the ArmCorp affiliate. The group has become one of the most active ransomware actors of 2026 by victim volume and leak-site activity. The operation uses a double-extortion model, combining data theft with file encryption, and targets organizations across numerous sectors and regions. Reported victimology includes manufacturing, healthcare, financial services, technology, logistics, government, education, business services, and critical infrastructure. Geographic targeting appears broad, with notable activity reported across Europe, Southeast Asia, South America, Australia, and North America. Some reporting indicates the group avoids targeting Commonwealth of Independent States countries. The Gentlemen is notable for centrally equipping affiliates with standardized defense-evasion tooling rather than leaving such development to individual operators. Its in-house GentleKiller framework is a bring-your-own-vulnerable-driver (BYOVD) EDR/AV killer suite with multiple variants that impersonate legitimate software and abuse signed vulnerable or malicious kernel drivers to terminate security products at scale. Reporting also links the group to additional security-disabling tools including HexKiller, ThrottleBlood, HavocKiller, and custom tooling incorporating PoisonX. The group has been observed rapidly operationalizing newly disclosed BYOVD techniques and, in at least one documented case, abusing a vulnerable Kontron driver to obtain kernel-level code execution and terminate protected security processes. Initial access commonly relies on exploitation of internet-facing edge infrastructure and valid credentials rather than phishing as the primary vector. Reported access methods include exploitation of firewalls, VPN appliances, public-facing services, brute force, stolen or leaked credentials, and cooperation with initial access brokers. Post-compromise activity includes Active Directory reconnaissance, credential theft, network discovery, packet capture, lateral movement with administrative tooling, abuse of Group Policy and shared domain resources for broad deployment, and encrypted data exfiltration prior to ransomware execution. The malware ecosystem associated with The Gentlemen includes mature Go-based ransomware and additional C-based variants. The encryptors are reported to support cross-platform targeting, including Windows, Linux, ESXi, NAS, and BSD environments. Observed tradecraft includes process and service termination, shadow copy deletion, event log clearing, persistence via scheduled tasks and autoruns, ACL manipulation, self-deletion, and in some cases worm-like or self-propagating lateral movement. The group also uses custom backdoors and common remote administration or post-exploitation tooling to maintain access and coordinate operations. The Gentlemen recruits affiliates on major cybercrime forums and has been reported to offer unusually favorable revenue sharing to affiliates. A significant internal leak in May 2026 exposed chats, victim data, negotiations, payouts, and tooling details, providing unusual visibility into the group’s organization and affiliate support model. Reporting also indicates the operators have used mainstream large language models such as ChatGPT, Gemini, and Claude to assist development and operations. Known aliases and tracking names include Storm-2697. The group is widely assessed as a sophisticated criminal enterprise rather than a state-sponsored actor, though its scale, tooling maturity, and operational tempo place it among the most consequential ransomware threats observed in 2026.