# The Gentlemen RaaS (Storm-2697) — Multi-Platform Ransomware-as-a-Service with BYOVD Defense Evasion and Self-Propagating Go Encryptor

> The Gentlemen is a ransomware-as-a-service operation, tracked by Microsoft as Storm-2697, that has claimed over 500 victims across 70+ countries and ranked in the top 10 ransomware actors by victim announcements in H1 2026. It operates a self-propagating Go-based encryptor (Curve25519 + XChaCha20), a C-based Windows variant in development (AES256-GCM + RSA), a custom Go backdoor, and an ESXi/Linux locker, using an in-house BYOVD framework ("GentleKiller") with at least eight vulnerable-driver variants to terminate 400+ security processes across 48 vendors.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1220
- **ID:** TL-2026-1220
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Gentlemen RaaS emerged mid-2025 as a Go-based ransomware family and began offering affiliate partnerships in September 2025, subsequently establishing recruitment ties with BreachForums. By early 2026 the group had ramped up operations sharply, and Kaspersky's Securelist began tracking it in February 2026; by April 2026 Microsoft observed it accounting for roughly 10% of global ransomware activity, ranking among the top 10 RaaS actors by victim announcements in H1 2026.

The group's primary payload is a Go-based ransomware protected by a custom Go obfuscator that scrambles symbols and function signatures, requires a hardcoded execution password (CbdU8EgF), and implements a hybrid cryptographic scheme: for each file, the malware generates an ephemeral Curve25519 key pair, computes an ECDH shared secret against the operator's embedded public key (Base64: HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=), derives the XChaCha20 key from that shared secret, and derives the nonce from the first 24 bytes of the ephemeral public key. Large files receive partial/intermittent encryption (3 distributed chunks at operator-configurable speeds of 0.3%-9%), while files under 1MB are fully encrypted; the ephemeral public key is stored Base64-encoded in a footer so operators can recover the shared secret and decrypt. The ransom note (README-GENTLEMEN.txt) directs victims to a Tox Messenger ID for negotiation, and the desktop wallpaper is replaced with an operator-supplied image.

A parallel C-based Windows variant remains under active development with unimplemented parameters; it uses AES256-GCM with RSA-wrapped keys, generating a random 32-byte key and 16-byte IV per file, drops a differently formatted ransom note (!-READ-ME—-GEN-TLE-MEN-!.txt), and has shifted victim communication from Tox to email — suggesting operational maturation toward a distinct negotiation channel. A custom Go-based backdoor (sample sihost.exe) uses the Yamux library to maintain a persistent TCP connection to a hardcoded C2 (81.177.215[.]15:9443), exfiltrates host telemetry (hostname, domain membership, UUID, local IPs gathered via WMI) as JSON, accepts remote command execution, and offers SOCKS proxying for network pivoting. A cross-platform ESXi/Linux locker rounds out the toolset for hypervisor and Linux server encryption.

Operationally, The Gentlemen affiliates gain initial access through exploitation of internet-facing service vulnerabilities, stolen or weak VPN/firewall credentials, and probable collaboration with Initial Access Brokers — with observed dwell times ranging from a few hours to several weeks depending on affiliate tradecraft. Reconnaissance relies on SharpADWS (SOAP-wrapped LDAP over ADWS to evade traditional LDAP monitoring), NetScan and Advanced IP Scanner for host/network enumeration, native netsh packet capture, and Wireshark analysis of captured traffic to harvest credentials.

The encryptor is notably self-propagating: rather than relying on a single lateral-movement path, it simultaneously fires 21 distinct techniques per target host without waiting on prior success, first staging payloads to C:\Temp and a hidden SMB share (share$), embedding or downloading PsExec, then executing via remote C$ copy, PsExec, multiple WMIC process-creation variants, six scheduled-task variants (user/system context, three each), three Windows service-creation variants, PowerShell Remoting (Invoke-Command), and PowerShell WMI-class execution. Domain-wide propagation is reinforced via NETLOGON share malware placement and a deploy_gpo.ps1 Group Policy Object push targeting domain controllers, with Remote Server Administration Tools (RSAT) and NetServerEnum API fallback used for domain computer enumeration when PowerShell paths fail.

Defense evasion is extensive and layered. The group markets its own EDR/AV-killer framework, GentleKiller, comprising at least eight distinct BYOVD (Bring Your Own Vulnerable Driver) variants abusing legitimately signed but vulnerable kernel drivers — including Safetica DLP/EDR's ProcessMonitorDriver.sys, WatchDog Anti-Malware's wamsdk.sys, an anti-cheat driver (gamedriverx64.sys), Paragon's biontdrv.sys partition-manager driver, a legacy RGB-lighting driver (inpoutx64.sys), Topaz anti-fraud's wsddprm.sys, and a Huawei audio driver (havoc.sys) — collectively capable of terminating 400+ security processes across 48 vendors. Kaspersky-specific tradecraft includes kavrmvr.exe to attempt uninstallation of Kaspersky products (blocked by behavioral detection), alongside Windows Kernel Explorer and OpenArk64 for manual driver enumeration/removal. PowerShell and registry tradecraft disables Microsoft Defender real-time monitoring and exclusions (Set-MpPreference -DisableRealtimeMonitoring $true -Force; DisableAntiSpyware=1; DisableBehaviorMonitoring=1 registry keys).

Pre-encryption impact staging includes forced shutdown of Hyper-V virtual machines (Get-VM | Stop-VM -Force -TurnOff), termination of 60+ processes and services spanning databases, backup agents, RMM tools, Office applications, and virtualization software via taskkill.exe and sc.exe, ACL manipulation via takeown.exe/icacls.exe to guarantee write access for encryption, and persistence via a scheduled task (UpdateUser) and a Run-key registry value (GupdateS). Post-encryption anti-forensic cleanup deletes Volume Shadow Copies (vssadmin.exe delete shadows /all /quiet, also via wmic), clears System/Application/Security event logs (wevtutil), purges Prefetch and RDP log directories, and empties the Recycle Bin.

Microsoft attributes operation of the RaaS platform to Storm-2697, a financially motivated actor group, and assigns the detection name Ransom:Win64/Gentlemen. High-confidence attribution derives from consistent group branding across binaries and ransom notes, associated negotiation email addresses, a dedicated Data Leak Site, and leaked internal affiliate communications corroborating continued operational activity. Victimology spans manufacturing, IT services, healthcare, financial services, construction, logistics, education, and transportation sectors across a broad geography — Brazil, China, Indonesia, Taiwan, and Thailand rank highest by Kaspersky telemetry, while Microsoft observed impact across North America, South America, Europe, Africa, and Asia — consistent with an affiliate-driven RaaS model with minimal sector/geographic targeting discipline.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1053 Scheduled Task/Job
- T1569 System Services
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1112 Modify Registry
- T1070 Indicator Removal
- T1222 File and Directory Permissions Modification
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1040 Network Sniffing
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1087 Account Discovery
- T1482 Domain Trust Discovery
- T1082 System Information Discovery
- T1007 System Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1550 Use Alternate Authentication Material
- T1090 Proxy
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1005 Data from Local System
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1588 Obtain Capabilities
- T1585 Establish Accounts

## Sources

- [The Gentlemen RaaS: rapid growth and a new ransomware variant](https://securelist.com/the-gentlemen-raas/120447/)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor (mirror)](https://thewindowsupdate.com/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://radar.offseq.com/threat/the-gentlemen-ransomware-dissecting-a-self-propaga-92b551d4)
- [The Gentlemen Ransomware: 483 Victims, 90% Cut](https://tech-insider.org/the-gentlemen-ransomware-2026/)
- [Emergence and Operations of The Gentlemen Ransomware-as-a-Service Group](https://www.mallory.ai/stories/019a9f35-153e-76a5-bf1f-d8cba056e959)
- [The Gentlemen Ransomware With Custom EDR/AV Killers Scaling Faster to Attack Industries Worldwide](https://cybersecuritynews.com/gentlemen-ransomware-global-attacks/)
- [The Gentlemen Ransomware With Custom EDR/AV Killers Scaling Faster to Attack Industries Worldwide](https://www.cryptika.com/the-gentlemen-ransomware-with-custom-edr-av-killers-scaling-faster-to-attack-industries-worldwide/)
- [How The Gentlemen Ransomware Spreads and Encrypts Entire Networks](https://www.picussecurity.com/resource/blog/how-the-gentlemen-ransomware-spreads-and-encrypts-entire-networks)
- [Modus Operandi: The Gentlemen (Storm-2697)](https://cyberwarrior76.substack.com/p/modus-operandi-the-gentlemen-storm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1220