The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program — Threadlinqs Intelligence
As of 2026-08-11, The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program is a critical-severity ransomware threat attributed to Storm-2697 / The Gentlemen (administrator identified as Alexander Andreevich Yapaev, aka hastalamuerte/zeta88/SantaMuerte) (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 116 indicators of compromise.
Threat ID: TL-2026-1138 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: RANSOMWARE
Updated: 2026-08-11 · 6 updates · revalidated 6× · latest source
Attribution: Storm-2697 / The Gentlemen (administrator identified as Alexander Andreevich Yapaev, aka hastalamuerte/zeta88/SantaMuerte) · Russia · FINANCIAL
The Gentlemen is a Go-based, Garble-obfuscated Ransomware-as-a-Service operated by Microsoft-tracked threat cluster Storm-2697 (administrator alias zeta88/hastalamuerte), first seen mid-2025 with an
The Gentlemen is a financially motivated Ransomware-as-a-Service (RaaS) operation tracked by Microsoft Threat Intelligence as Storm-2697. The group began as a closed ransomware crew around mid-2025 (earliest known Windows encryptor sample uploaded to VirusTotal on 2025-07-17), transitioned to an open affiliate model in September 2025 under a 90/10 (affiliate/operator) profit split, and in May 2026 formalized an official partnership with the BreachForums cybercrime marketplace to recruit penetration testers and initial-access brokers after suffering its own infrastructure breach.
Affiliates gain initial access primarily by targeting internet-exposed edge appliances — brute-forcing and exploiting Fortinet FortiOS/FortiProxy (CVE-2024-55591) and Erlang/OTP SSH servers (CVE-2025-32433), abusing NTLM reflection against unsigned SMB (CVE-2025-33073) for SYSTEM-level privilege escalation, purchasing credentials/access from initial access brokers, and in at least one documented case reusing credentials stolen from a breached UK consultancy to compromise a downstream Turkish client (a trusted-relationship/supply-chain technique the group has weaponized for double-pressure extortion). Post-compromise, affiliates deploy Cobalt Strike beacons and the SystemBC SOCKS5 proxy for covert C2/tunneling, alongside a toolkit of signed/legitimate software abused for evasion (Velociraptor, TailVNC, Rclone, OpenConnect) and offensive AD tooling (NetExec, CertiHound, PowerZure, RegPwn, KslDump/KslKatz).
The ransomware payload itself, written in Go and obfuscated with Garble, is engineered for worm-like self-propagation: on each target host it attempts up to 21 distinct remote-execution operations across six technique families (PsExec in three variants, WMIC process creation in three variants, user- and SYSTEM-context scheduled tasks, service-based execution, PowerShell remoting, and PowerShell WMI execution) plus SMB C$ share copy and a self-hosted anonymous SMB share (\\<self>\share$). Before encrypting, the malware performs extensive defense evasion: disabling Microsoft Defender real-time protection and excluding the entire C:\ volume, deleting Volume Shadow Copies via two independent methods, clearing System/Application/Security event logs and PowerShell history, clearing Defender/RDP logs and prefetch files, disabling Domain/Public/Private firewall profiles, re-enabling legacy SMB1, and loosening anonymous (null-session) SMB access via registry modification. It forcibly terminates 40+ processes and 60+ services spanning databases (SQL Server), backup software (Veeam), EDR agents, and virtualization platforms (Hyper-V) before encryption begins. In a documented DFIR case, a Gentlemen affiliate used GPO-based deployment to trigger near-simultaneous ransomware execution (renamed r.exe/g.exe/o.exe) across an entire domain after establishing Domain Admin access.
Encryption uses a per-file ephemeral Curve25519 key pair, an ECDH shared secret computed against the operator's embedded public key, and XChaCha20 stream encryption; files under 1 MB are fully encrypted while larger files are partially encrypted in three 64 KB chunks at varying speed settings (--fast/--superfast/--ultrafast) to accelerate large-scale encryption runs. Encrypted files receive the .umc16h extension and a README-GENTLEMEN.txt ransom note is dropped in every scanned directory; the desktop wallpaper is replaced with gentlemen.bmp. The group operates double-extortion via a Tor data-leak site and a separate Tor negotiation portal, and had listed roughly 483 victims across 66 countries by mid-June 2026 spanning education, transportation, healthcare, financial-services, and professional-services sectors on five continents. A May 2026 breach of Gentlemen's own "Rocket" backend (leaked by actor n7778) exposed operator/affiliate identities, Rocket.Chat logs, ransom-negotiation transcripts (including a $250,000-to-$190,000 negotiated case), and confirmed the group's use of AI coding assist
Weaknesses (CWE)
CWE-288, CWE-306, CWE-287, CWE-284, CWE-502, CWE-269, CWE-782, CWE-244
Target sectors: education, transport, health, financial services, professional services, technology
Target regions: North America, 005 - South America, Europe, Africa, Asia
Update History
- 2026-08-11 — The Gentlemen Ransomware: FortiGate Auth-Bypass (CVE-2024-55591) Initial Access, ThrottleBlood BYOVD (CVE-2025-7771) AV-Killer, and NETLOGON-Based Lateral Movement: What changed No field-level escalations applied. The new report's severity_level (HIGH) and attribution_confidence (MEDIUM) are lower than the existing record's (CRITICAL / HIGH) and its nation_state (Unknown) is less specific than the exis
- 2026-07-31 — Gentlemen Ransomware (Phantom Mantis / Storm-2697) Deploys anticheatG13.sys Kernel Driver to Kill 180+ Security Processes Before Encryption: What changed No severity/exploitability/status escalation applied. The new report's own severity (HIGH vs. existing CRITICAL) and attribution_confidence (MEDIUM vs. existing HIGH) are both lower than the existing record and were withheld pe
- 2026-07-28 — The Gentlemen Ransomware-as-a-Service Surpasses Qilin as #1 RaaS via 90/10 Affiliate Split, Kernel-Level EDR Killers, and CVE-2024-55591 FortiOS Exploitation: What changed Nation-state attribution escalated Unknown → Russia, with the RaaS administrator now identified by name (Alexander Andreevich Yapaev, Izhevsk, Udmurt Republic) and aliases (hastalamuerte, zeta88, SantaMuerte, bu4vs, 4apai18) vi
- 2026-07-27 — The Gentlemen (Storm-2697): Global RaaS Double-Extortion Operation Exploiting FortiGate CVE-2024-55591, BYOVD EDR Killing, and GPO-Driven Mass Encryption: What changed No field escalations warranted: severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), and CVSS (9.8) are all unchanged and already at maximum. The newer report's attribution_confidence (MEDIUM) is lower than the existi
- 2026-07-10 — The Gentlemen Ransomware (Storm-2697) — RaaS Affiliate Program with 90% Payout Exploiting Fortinet, Erlang/OTP, SMB & React2Shell Edge Vulnerabilities, 580+ Victims: What changed Attack surface expanded to include CVE-2025-55182 (React2Shell) as a fourth exploited edge/app vulnerability; CVSS 9.8 confirmed for the FortiOS bypass (previously unscored); victim count grown to 580 across 77 countries with m
- 2026-07-10 — The Gentlemen Ransomware (Storm-2697): 21 Remote Execution Techniques, GentleKiller BYOVD Suite, and Curve25519/XChaCha20 Double Extortion: What changed No downgrade applied: the newer report's severity_level (HIGH) and attribution_confidence (MEDIUM) are both lower than the existing record's (CRITICAL / HIGH) and were ignored per escalation-only policy. Exploitability remains
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 116 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-7771, CVE-2023-27532, CVE-2025-55182, CVE-2022-42045, CVE-2025-26125, T1595, T1591, T1583, T1587, T1588, T1585, T1190, T1133, T1078, T1199
