# The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program

> The Gentlemen is a Go-based, Garble-obfuscated Ransomware-as-a-Service operated by Microsoft-tracked threat cluster Storm-2697 (administrator alias zeta88/hastalamuerte), first seen mid-2025 with an affiliate program launched September 2025 and a formal BreachForums recruitment partnership since May 2026. It self-propagates across Windows networks using up to 21 remote execution techniques before encrypting files with a hybrid Curve25519/XChaCha20 scheme, and has hit education, transportation, healthcare, financial-services, and professional-services organizations across five continents.

- **Published:** 2026-07-06T00:00:00Z
- **Last reviewed:** 2026-09-08T03:47:21.264Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1138
- **ID:** TL-2026-1138
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Storm-2697 (Russia)
- **Detections:** 9 · **IOCs:** 144 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-7771, CVE-2023-27532, CVE-2025-55182, CVE-2022-42045, CVE-2025-26125

## Description

The Gentlemen is a financially motivated Ransomware-as-a-Service (RaaS) operation tracked by Microsoft Threat Intelligence as Storm-2697. The group began as a closed ransomware crew around mid-2025 (earliest known Windows encryptor sample uploaded to VirusTotal on 2025-07-17), transitioned to an open affiliate model in September 2025 under a 90/10 (affiliate/operator) profit split, and in May 2026 formalized an official partnership with the BreachForums cybercrime marketplace to recruit penetration testers and initial-access brokers after suffering its own infrastructure breach.

Affiliates gain initial access primarily by targeting internet-exposed edge appliances — brute-forcing and exploiting Fortinet FortiOS/FortiProxy (CVE-2024-55591) and Erlang/OTP SSH servers (CVE-2025-32433), abusing NTLM reflection against unsigned SMB (CVE-2025-33073) for SYSTEM-level privilege escalation, purchasing credentials/access from initial access brokers, and in at least one documented case reusing credentials stolen from a breached UK consultancy to compromise a downstream Turkish client (a trusted-relationship/supply-chain technique the group has weaponized for double-pressure extortion). Post-compromise, affiliates deploy Cobalt Strike beacons and the SystemBC SOCKS5 proxy for covert C2/tunneling, alongside a toolkit of signed/legitimate software abused for evasion (Velociraptor, TailVNC, Rclone, OpenConnect) and offensive AD tooling (NetExec, CertiHound, PowerZure, RegPwn, KslDump/KslKatz).

The ransomware payload itself, written in Go and obfuscated with Garble, is engineered for worm-like self-propagation: on each target host it attempts up to 21 distinct remote-execution operations across six technique families (PsExec in three variants, WMIC process creation in three variants, user- and SYSTEM-context scheduled tasks, service-based execution, PowerShell remoting, and PowerShell WMI execution) plus SMB C$ share copy and a self-hosted anonymous SMB share (\\<self>\share$). Before encrypting, the malware performs extensive defense evasion: disabling Microsoft Defender real-time protection and excluding the entire C:\ volume, deleting Volume Shadow Copies via two independent methods, clearing System/Application/Security event logs and PowerShell history, clearing Defender/RDP logs and prefetch files, disabling Domain/Public/Private firewall profiles, re-enabling legacy SMB1, and loosening anonymous (null-session) SMB access via registry modification. It forcibly terminates 40+ processes and 60+ services spanning databases (SQL Server), backup software (Veeam), EDR agents, and virtualization platforms (Hyper-V) before encryption begins. In a documented DFIR case, a Gentlemen affiliate used GPO-based deployment to trigger near-simultaneous ransomware execution (renamed r.exe/g.exe/o.exe) across an entire domain after establishing Domain Admin access.

Encryption uses a per-file ephemeral Curve25519 key pair, an ECDH shared secret computed against the operator's embedded public key, and XChaCha20 stream encryption; files under 1 MB are fully encrypted while larger files are partially encrypted in three 64 KB chunks at varying speed settings (--fast/--superfast/--ultrafast) to accelerate large-scale encryption runs. Encrypted files receive the .umc16h extension and a README-GENTLEMEN.txt ransom note is dropped in every scanned directory; the desktop wallpaper is replaced with gentlemen.bmp. The group operates double-extortion via a Tor data-leak site and a separate Tor negotiation portal, and had listed roughly 483 victims across 66 countries by mid-June 2026 spanning education, transportation, healthcare, financial-services, and professional-services sectors on five continents. A May 2026 breach of Gentlemen's own "Rocket" backend (leaked by actor n7778) exposed operator/affiliate identities, Rocket.Chat logs, ransom-negotiation transcripts (including a $250,000-to-$190,000 negotiated case), and confirmed the group's use of AI coding assistants (DeepSeek, Qwen, Kimi) to build its RaaS panel ("GLOCKER") in as little as three days.

## MITRE ATT&CK

- T1595 Active Scanning
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1053 Scheduled Task/Job
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1112 Modify Registry
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1622 Debugger Evasion
- T1557 Adversary-in-the-Middle
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1082 System Information Discovery
- T1135 Network Share Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1119 Automated Collection
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service

## Sources

- [How The Gentlemen Ransomware Spreads and Encrypts Entire Networks](https://www.picussecurity.com/resource/blog/how-the-gentlemen-ransomware-spreads-and-encrypts-entire-networks)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)
- [Thus Spoke...The Gentlemen](https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/)
- [DFIR Report - The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy](https://research.checkpoint.com/2026/dfir-report-the-gentlemen/)
- [Inside The Gentlemen Ransomware Leak: When the Hunter Becomes the Hunted](https://socradar.io/blog/gentlemen-ransomware-leak/)
- [Inside The Gentlemen Leak: How a New RaaS Captured 10% of 2026's Global Ransomware Victims](https://www.kelacyber.com/blog/the-gentlemen-ransomware-internal-chat-leak-analysis-2026/)
- [The Gentlemen Ransomware: 483 Victims, 90% Cut 2026](https://tech-insider.org/the-gentlemen-ransomware-2026/)
- [The Gentlemen Ransomware THREAT PROFILE](https://blackpointcyber.com/wp-content/uploads/2025/11/The-Gentlemen.pdf)
- [CVE-2025-33073 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-33073)
- [CVE-2024-55591 Detail](https://nvd.nist.gov/vuln/detail/cve-2024-55591)
- [CVE-2025-32433 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-32433)
- [Emergence and Operations of The Gentlemen Ransomware-as-a-Service Group](https://www.mallory.ai/stories/019a9f35-153e-76a5-bf1f-d8cba056e959)
- [The Gentlemen Ransomware: Threat Intelligence Analysis, TTPs & Detection Guide](https://redpiranha.net/news/the-gentlemen-ransomware-analysis)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1138