Threat reportRansomwareTL-2026-1138

The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program

criticalACTIVE

The Gentlemen Ransomware (TL-2026-1138), also tracked as The Gentlemen, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-07-06 and last reviewed 2026-09-08. It is attributed to Storm-2697 (Russia) with high confidence, affects Fortinet FortiOS / FortiProxy, references 8 CVEs (CVE-2024-55591, CVE-2025-32433, CVE-2025-33073), maps to at least 80 MITRE ATT&CK techniques (T1003, T1003.001, T1003.004), and is covered by 9 detection rules and 144 indicators of compromise.

CVSS
9.8/10Critical
CVEs
8Referenced vulnerabilities
Techniques
80+MITRE ATT&CK
Actors
1Storm-2697
Detection rules
9SPL · KQL · Sigma
IOCs
144Indicators of compromise

Key facts for TL-2026-1138

Threat ID
TL-2026-1138
Also known as
The Gentlemen, GLOCKER
Severity
CRITICAL
CVSS
9.8
Status
ACTIVE
Category
RANSOMWARE
First published
Last reviewed
Attribution
Storm-2697
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
education, transport, health, financial services, professional services, technology
Target regions
North America, 005 - South America, Europe, Africa, Asia
Detection rules
9
Indicators of compromise
144
Updates
2026-09-08 · 8 updates · revalidated 8× · latest source

Malware and tooling in The Gentlemen Ransomware

Malware and tooling: GLOCKER, SystemBC - S9001, Advanced IP Scanner, AnyDesk, CertiHound, Cloudflare Zero Trust/Tunnels, Cobalt Strike, GentleKiller, NetExec (NXC), OxideHarvest, PSEXEC, Rclone - S1040

How The Gentlemen Ransomware works

The Gentlemen is a Go-based, Garble-obfuscated Ransomware-as-a-Service operated by Microsoft-tracked threat cluster Storm-2697 (administrator alias zeta88/hastalamuerte), first seen mid-2025 with an affiliate program launched September 2025 and a formal BreachForums recruitment partnership since May 2026. It self-propagates across Windows networks using up to 21 remote execution techniques before encrypting files with a hybrid Curve25519/XChaCha20 scheme, and has hit education, transportation, healthcare, financial-services, and professional-services organizations across five continents.

The Gentlemen is a financially motivated Ransomware-as-a-Service (RaaS) operation tracked by Microsoft Threat Intelligence as Storm-2697. The group began as a closed ransomware crew around mid-2025 (earliest known Windows encryptor sample uploaded to VirusTotal on 2025-07-17), transitioned to an open affiliate model in September 2025 under a 90/10 (affiliate/operator) profit split, and in May 2026 formalized an official partnership with the BreachForums cybercrime marketplace to recruit penetration testers and initial-access brokers after suffering its own infrastructure breach.

Affiliates gain initial access primarily by targeting internet-exposed edge appliances — brute-forcing and exploiting Fortinet FortiOS/FortiProxy (CVE-2024-55591) and Erlang/OTP SSH servers (CVE-2025-32433), abusing NTLM reflection against unsigned SMB (CVE-2025-33073) for SYSTEM-level privilege escalation, purchasing credentials/access from initial access brokers, and in at least one documented case reusing credentials stolen from a breached UK consultancy to compromise a downstream Turkish client (a trusted-relationship/supply-chain technique the group has weaponized for double-pressure extortion). Post-compromise, affiliates deploy Cobalt Strike beacons and the SystemBC SOCKS5 proxy for covert C2/tunneling, alongside a toolkit of signed/legitimate software abused for evasion (Velociraptor, TailVNC, Rclone, OpenConnect) and offensive AD tooling (NetExec, CertiHound, PowerZure, RegPwn, KslDump/KslKatz).

The ransomware payload itself, written in Go and obfuscated with Garble, is engineered for worm-like self-propagation: on each target host it attempts up to 21 distinct remote-execution operations across six technique families (PsExec in three variants, WMIC process creation in three variants, user- and SYSTEM-context scheduled tasks, service-based execution, PowerShell remoting, and PowerShell WMI execution) plus SMB C$ share copy and a self-hosted anonymous SMB share (\\<self>\share$). Before encrypting, the malware performs extensive defense evasion: disabling Microsoft Defender real-time protection and excluding the entire C:\ volume, deleting Volume Shadow Copies via two independent methods, clearing System/Application/Security event logs and PowerShell history, clearing Defender/RDP logs and prefetch files, disabling Domain/Public/Private firewall profiles, re-enabling legacy SMB1, and loosening anonymous (null-session) SMB access via registry modification. It forcibly terminates 40+ processes and 60+ services spanning databases (SQL Server), backup software (Veeam), EDR agents, and virtualization platforms (Hyper-V) before encryption begins. In a documented DFIR case, a Gentlemen affiliate used GPO-based deployment to trigger near-simultaneous ransomware execution (renamed r.exe/g.exe/o.exe) across an entire domain after establishing Domain Admin access.

Encryption uses a per-file ephemeral Curve25519 key pair, an ECDH shared secret computed against the operator's embedded public key, and XChaCha20 stream encryption; files under 1 MB are fully encrypted while larger files are partially encrypted in three 64 KB chunks at varying speed settings (--fast/--superfast/--ultrafast) to accelerate large-scale encryption runs. Encrypted files receive the .umc16h extension and a README-GENTLEMEN.txt ransom note is dropped in every scanned directory; the desktop wallpaper is replaced with gentlemen.bmp. The group operates double-extortion via a Tor data-leak site and a separate Tor negotiation portal, and had listed roughly 483 victims across 66 countries by mid-June 2026 spanning education, transportation, healthcare, financial-services, and professional-services sectors on five continents. A May 2026 breach of Gentlemen's own "Rocket" backend (leaked by actor n7778) exposed operator/affiliate identities, Rocket.Chat logs, ransom-negotiation transcripts (including a $250,000-to-$190,000 negotiated case), and confirmed the group's use of AI coding assistants (DeepSeek, Qwen, Kimi) to build its RaaS panel ("GLOCKER") in as little as three days.

MITRE ATT&CK techniques used in TL-2026-1138

Credential Access

T1003 OS Credential Dumping; T1003.001 OS Credential Dumping: LSASS Memory; T1003.004 OS Credential Dumping: DPAPI; T1040 Network Sniffing; T1110 Brute Force; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System; T1074 Data Staged; T1119 Automated Collection; T1213 Data from Information Repositories

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036 Masquerading; T1036.001 Masquerading: Invalid Code Signature; T1036.004 Masquerade Task or Service; T1036.005 Masquerading: Match Legitimate Name or Location; T1070 Indicator Removal; T1070.001 Indicator Removal: Clear Windows Event Logs; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth; T1218 System Binary Proxy Execution; T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1087.002 Domain Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery

Lateral Movement

T1021 Remote Services; T1021.001 Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 SSH; T1210 Exploitation of Remote Services

Persistence

T1037.004 RC Scripts; T1098 Account Manipulation; T1098.007 Account Manipulation: Additional Local or Domain Groups; T1136 Create Account; T1136.002 Create Account: Domain Account; T1543 Create or Modify System Process; T1543.003 Create or Modify System Process: Windows Service; T1547 Boot or Logon Autostart Execution

Execution

T1047 Windows Management Instrumentation; T1053 Scheduled Task/Job; T1053.005 Scheduled Task/Job: Scheduled Task; T1059 Command and Scripting Interpreter; T1059.003 Windows Command Shell; T1106 Native API; T1204.002 User Execution: Malicious File

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1090.001 Proxy: Internal Proxy; T1090.002 Proxy: External Proxy; T1090.003 Multi-hop Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Initial Access

T1078 Valid Accounts; T1078.002 Valid Accounts: Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

defense-impairment

T1112 Modify Registry; T1222 File and Directory Permissions Modification; T1484 Domain or Tenant Policy Modification; T1553 Subvert Trust Controls

stealth

T1480 Execution Guardrails

Impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1491 Defacement; T1529 System Shutdown/Reboot

Affected products and versions in The Gentlemen Ransomware

  • Fortinet — FortiOS / FortiProxy
    Vulnerable versions: FortiOS 7.0.0-7.0.16; FortiProxy 7.0.0-7.0.19; FortiProxy 7.2.0-7.2.12
    Fixed in: FortiOS 7.0.17+; FortiProxy 7.0.20+
  • Erlang/OTP — Erlang/OTP SSH Server
    Vulnerable versions: OTP-27.0-rc1 to <27.3.3; OTP-26.0-rc1 to <26.2.5.11; <25.3.2.20
    Fixed in: OTP-27.3.3; OTP-26.2.5.11; OTP-25.3.2.20
  • Microsoft — Windows SMB Client (NTLM Reflection)
    Vulnerable versions: Windows hosts without SMB signing enforcement (pre-2025 SMB hardening update)
    Fixed in: Windows builds with SMB client hardening against marshalled target-name NTLM reflection
  • Multiple — Windows Server / Workstation (targeted via LOLBins and admin shares)
    Vulnerable versions: All supported Windows versions lacking EDR/ASR hardening and SMB signing enforcement
    Fixed in: N/A - behavioral hardening required
  • Broadcom/VMware — ESXi (targeted by Linux ransomware variant)
    Vulnerable versions: ESXi hosts reachable via compromised administrative credentials
    Fixed in: N/A - credential/segmentation hardening required

Remediation for The Gentlemen Ransomware

Patches

  • Fortinet FortiOS 7.0.17+ / FortiProxy 7.0.20+ (CVE-2024-55591)
  • Erlang/OTP 27.3.3 / 26.2.5.11 / 25.3.2.20 (CVE-2025-32433)
  • Microsoft Windows SMB client update addressing NTLM reflection (CVE-2025-33073)

Immediate actions

  • Patch Fortinet FortiOS to 7.0.17+ and FortiProxy to 7.0.20+ to close CVE-2024-55591 authentication bypass
  • Patch Erlang/OTP to 27.3.3, 26.2.5.11, or 25.3.2.20 to close CVE-2025-32433 pre-auth RCE in the SSH server
  • Apply the Microsoft update enforcing SMB client hardening to block CVE-2025-33073 NTLM reflection privilege escalation
  • Enforce SMB signing on all domain-joined hosts and disable SMBv1 organization-wide
  • Enable Microsoft Defender tamper protection, cloud-delivered protection, and controlled folder access
  • Block outbound connections to known C2 IPs 45.86.230.112 and 91.107.247.163
  • Hunt for and remove scheduled tasks named gentlemen_system, UpdateSystem, UpdateUser, DefU, DefSvc, UpdateGU, UpdateGU2, UpdateSvc, UpdateSvc2
  • Isolate hosts exhibiting shadow-copy deletion, mass event-log clearing, or new Defender exclusions/firewall-profile disablement

Workarounds

  • Restrict SSH access to Erlang/OTP servers from untrusted networks pending patch
  • Restrict FortiGate/FortiProxy management-interface access to trusted management networks only
  • Enforce SMB signing organization-wide as a compensating control if patching is delayed
  • Disable anonymous/null-session SMB access (RestrictNullSessAccess) domain-wide

Longer-term hardening

  • Deploy EDR with tamper protection and automatic attack disruption in block mode across all endpoints
  • Segment networks to limit the blast radius of SMB/WMI/PsExec/PowerShell-remoting-based lateral movement
  • Enforce least-privilege for domain admin accounts and alert on anomalous GPO creation/modification
  • Implement offline/immutable backups resilient to vssadmin/wmic shadow-copy deletion and free-space wiping
  • Continuously monitor edge appliances (Fortinet, Cisco, VPN gateways) for exploitation and enforce rapid patch SLAs
  • Deploy attack surface reduction (ASR) rules blocking PsExec/WMI-initiated process creation and LSASS credential theft

CVEs associated with The Gentlemen Ransomware

CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-7771, CVE-2023-27532, CVE-2025-55182, CVE-2022-42045, CVE-2025-26125

Weaknesses (CWE) in The Gentlemen Ransomware

CWE-288, CWE-306, CWE-287, CWE-284, CWE-502, CWE-269, CWE-782, CWE-244

Timeline of The Gentlemen Ransomware

Showing the 20 most recent tracked events.

  • Microsoft Threat Intelligence publishes 'The Gentlemen ransomware: Dissecting a self-propagating Go encryptor,' formally attributing the RaaS platform to threat cluster Storm-2697 and detailing its 21 lateral-movement techniques and Curve25519/XChaCha20 encryption scheme.
  • Group-IB publishes a detailed TTP analysis attributing The Gentlemen to a splinter of the Qilin-affiliated ArmCorp crew, documenting the G-BOT C2 framework, NetExec-based lateral movement, and a full MITRE ATT&CK technique mapping.
  • Gurucul research documents a previously undisclosed custom Go-based backdoor communicating with C2 infrastructure at 81.177.215.15:9443.
  • Halcyon's Ransomware Research Center ranks The Gentlemen the top-ranked ransomware operation globally for the first time, surpassing Qilin, attributed to its unusually generous 90/10 affiliate revenue split.
  • Krebs on Security publishes attribution research identifying administrator Alexander Andreevich Yapaev of Izhevsk, Russia, citing Check Point, Intel 471, Constella Intelligence, Flashpoint, Epieos, and PRODAFT.
  • A Gentlemen-linked intrusion at Mackay Sugar encrypts IT systems hosting MES/SCADA databases, forcing a physical sugar-mill shutdown despite no direct PLC targeting — the first documented OT/ICS-adjacent impact from this group.
  • The Gentlemen claims 117 new victims in June 2026, its highest single-month total to date.
  • Security researchers detail the proprietary GentleKiller BYOVD EDR/AV-killer framework, an 8-driver suite capable of terminating 400+ security processes across 48 vendors.
  • The Gentlemen's Tor data-leak site reaches approximately 483 listed victims across 66 countries, spanning education, transportation, healthcare, and financial-services sectors on five continents.
  • Reporting links the large-scale 'FortiBleed' FortiGate VPN credential exposure - used by Gentlemen affiliates for victim selection alongside CVE-2024-55591 - to subsequent INC and Lynx ransomware intrusions, underscoring its continued impact beyond Gentlemen.
  • Picus Security publishes a detailed technical breakdown of The Gentlemen's self-propagation and encryption mechanics, the source hunt article prompting this research.
  • Cumulative claimed victim count reaches 580 across 77 countries; manufacturing (103 victims) becomes the leading target sector.
  • Unit 42 publishes a comprehensive profile naming The Gentlemen the second most active RaaS program tracked in 2026, behind only legacy operators Qilin and Akira, and reports probable lineage from an ArmCorp-branded Qilin (Spikey Scorpius) affiliate.
  • TL-Intel Harness compiles consolidated research from Microsoft, Cybereason, Picus Security, and The Hacker News reporting confirming the GentleKiller BYOVD suite and additional exploited CVEs.
  • TheInsurer reports The Gentlemen as the most active ransomware threat actor of Q2 2026, confirming the sustained #1 ranking.
  • Cyble CRIL's Global Threat Landscape H1 2026 report names The Gentlemen a top-tier global RaaS operator with 360+ H1 2026 attacks and the most active actor against government targets (22 attacks in H1 2026, up from one in H2 2025).
  • Catalyst (PRODAFT) publishes 'The Mantis Grip: Endpoint Defenses Pinned Before Encryption,' disclosing the anticheatG13.sys kernel driver (building on G12drv.sys) capable of killing ~180 security processes plus WFP redirection, driver-load blocking, command-line rewriting, and kernel-memory manipulation; covered by Cyber Security News.
  • Intel471 publishes 'Threat Hunting Case Study: The Gentlemen,' reporting over 600 claimed victims across 80+ countries (up from 580/77 on 2026-07-07) and detailing the ThrottleBlood BYOVD AV-killer chain plus NETLOGON/SYSVOL-based domain-wide lateral movement via rogue privileged-group account additions.
  • Comparitech reports 675 total claimed Gentlemen victims (600 in 2026) and approximately 796,000 records breached across confirmed attacks.
  • Group-IB publishes 'Ransomware in 2026: What the Data Demands From You,' citing The Gentlemen's 29-attack February 2026 APAC campaign alongside the IBM 2025 Cost of a Data Breach average of $5.08M per breach.

Update history for TL-2026-1138

Sources cited for The Gentlemen Ransomware

Detection coverage for TL-2026-1138

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1138 across Splunk SPL, Microsoft KQL and Sigma, covering 144 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
144 indicators of compromise · Red and above. Compare plans

Community OSINT corroboration for TL-2026-1138

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats