Threat reportRansomwareTL-2026-3832
Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment
Gentlemen Ransomware (Storm-2697) (TL-2026-3832), also tracked as Gentlemen, is a high-severity ransomware operation, first published 2026-10-17 and last reviewed 2026-10-22. It is attributed to The Gentlemen with medium confidence, affects Fortinet FortiOS / FortiProxy (FortiGate), references 8 CVEs (CVE-2024-55591, CVE-2025-7771, CVE-2023-27532), maps to 35 MITRE ATT&CK techniques (T1003.001, T1003.003, T1018), and is covered by 9 detection rules and 68 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 35MITRE ATT&CK
- Actors
- 1The Gentlemen
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 68Indicators of compromise
Key facts for TL-2026-3832
- Threat ID
- TL-2026-3832
- Also known as
- Gentlemen, GentleKiller, Storm-2697
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, manufacturing, technology, professional services, construction, insurance
- Target regions
- North America, Europe, Asia, Asia-Pacific, Latin America
- Detection rules
- 9
- Indicators of compromise
- 68
- Updates
- 2026-10-22 · 2 updates · revalidated 2× · latest source
Malware and tooling in Gentlemen Ransomware (Storm-2697)
Malware and tooling: AnyDesk, Gentlemen ransomware, Storm, SystemBC - S9001, Cobalt Strike, NetExec, PSEXEC
How Gentlemen Ransomware (Storm-2697) works
The Gentlemen is a Go-based, human-operated ransomware-as-a-service operation active since mid-2025 that exfiltrates data before encrypting Windows, Linux, NAS, BSD and ESXi systems. Intrusions start from compromised FortiGate/VPN access, disable EDR via vulnerable drivers and custom killers, and push the locker domain-wide through Group Policy and NETLOGON.
The Gentlemen (tracked by Microsoft as Storm-2697) is a ransomware-as-a-service operation first seen in mid-2025. The first Windows sample was uploaded to VirusTotal on 2025-07-17 and already contained the data leak site URL. Group-IB reports that the alleged administrator, handle 'hastalamuerte', was previously a Qilin affiliate and opened a RAMP arbitration against Qilin on 2025-07-22 over a commission dispute; this origin and the operator identity are attributed by researchers from forum activity and a hardcoded string in the locker and are not confirmed. The program moved to an affiliate model in September 2025 (reported 90/10 affiliate/operator split; Russia/CIS targets banned). Intel 471 describes the operation as stealth-focused, multi-stage and increasingly coordinated, with victims in healthcare, manufacturing, technology and professional services across North America, Europe and Asia. Other reporting adds construction and insurance, with Thailand and the US prominent.
Initial access in documented intrusions came from compromised or exposed FortiGate appliances, VPN credentials without MFA (including brute-forced VPN credentials), exposed admin panels, and exploitation of CVE-2024-55591 (FortiOS/FortiProxy authentication bypass). Group-IB reports the operator maintained an inventory of roughly 14,700 compromised FortiGate devices and a list of validated VPN credentials. After access, operators perform discovery with Advanced IP Scanner, SoftPerfect Network Scanner, Nmap, NetExec, BloodHound and similar tools, stage data under C:\PerfLogs and C:\ProgramData\data, create domain accounts, and harvest credentials (LSASS dumping, DPAPI backup key extraction with Impacket dpapi.py and DonPAPI, Veeam credential extraction).
Defense evasion is the group's signature. Operators disable Microsoft Defender with Set-MpPreference and exclusions, and kill EDR/AV with BYOVD: ThrottleStop.sys renamed ThrottleBlood.sys (CVE-2025-7771), plus custom killers All.exe and Allpatch2.exe and the 'GentleKiller' variants using drivers such as nogbc.sys, G11.sys and dmx.sys (one report counts at least eight variants terminating 400+ security processes across 48 vendors). PowerRun is used for privilege escalation, PsExec, AnyDesk, Datto RMM, Cobalt Strike, SystemBC (SOCKS5 proxy) and Cloudflared/Chisel tunnels for lateral movement and remote access. Persistence and execution use scheduled tasks named gentlemen_system, UpdateUser and UpdateSystem. Registry changes weaken NTLM restrictions and RDP security.
The locker pushes mass deployment by modifying Group Policy and staging the binary on the domain NETLOGON share, then forcing gpupdate. Its --spread mode attempts up to 21 distinct remote execution techniques against each reachable host. Before encryption it stops database, backup and virtualization services (MSSQL, MySQL, Oracle, PostgreSQL, Veeam, Acronis, Hyper-V and others), deletes shadow copies (vssadmin, wmic), clears Windows event logs and empties the Recycle Bin. The Go encryptor (Garble-obfuscated per Microsoft) uses per-file ephemeral Curve25519 keys with XChaCha20, requires an 8-byte --password argument, supports partial-encryption speed modes (default ~27%, --fast ~9%, --superfast ~3%, --ultrafast ~0.9%), appends a random six-character extension (e.g. .7mtzhh, .umc16h, .ojuopo) and drops README-GENTLEMEN.txt. An ESXi locker was released on 2025-09-10 and a VMware-destruction PowerShell script (VCENTER.ps1) was observed in operator materials.
Data is exfiltrated before encryption using Rclone (reported renamed avastrclone.exe, to SFTP such as 194.87.31.69:2222 or to Wasabi/MEGA), WinSCP, Restic and MinIO Client. Victims are given roughly 10 days before publication and are directed to Tox or an onion site. Claimed victim counts grew rapidly: ~94 organizations by late 2025 per Group-IB, 352 claimed attacks by 2026-05-10 per LevelBlue, and 965 victims across 90 countries by October 2026 per ProvenData. A May 2026 breach of the 4VPS hosting provider leaked internal chat logs and credentials, and an alleged internal leak was reported in February 2026 (unconfirmed). The article underlying this record (Intel 471) names no CVEs or IOCs; the technical details here are drawn from the cited third-party analyses.
MITRE ATT&CK techniques used in TL-2026-3832
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS; T1110.001 Brute Force: Password Guessing
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1083 File and Directory Discovery; T1087.002 Account Discovery: Domain Account; T1135 Network Share Discovery
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Execution
T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
Defense Evasion
T1070.003 Clear Command History; T1222.001 Windows File and Directory Permissions Modification; T1562.004 Disable or Modify System Firewall
Collection
T1074.001 Data Staged: Local Data Staging
Initial Access
T1078.002 Valid Accounts: Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1219 Remote Access Tools; T1573 Encrypted Channel
defense-impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Internal Defacement; T1561.001 Disk Content Wipe
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Affected products and versions in Gentlemen Ransomware (Storm-2697)
- Fortinet — FortiOS / FortiProxy (FortiGate)
Vulnerable versions: Versions affected by CVE-2024-55591
Fixed in: Fixed releases per Fortinet advisory - Microsoft — Windows / Active Directory domains
Vulnerable versions: Domains without MFA, tamper protection or driver blocklisting - VMware — ESXi / vCenter
Vulnerable versions: Targeted by ESXi locker; CVE-2024-37085 discussed by operator - Veeam — Backup & Replication
Vulnerable versions: Versions affected by CVE-2023-27532
Fixed in: Fixed releases per Veeam advisory - Linux/BSD/NAS — Linux, BSD and NAS hosts
Vulnerable versions: Targeted by Linux locker variant
Remediation for Gentlemen Ransomware (Storm-2697)
Patches
- FortiOS/FortiProxy fixed releases for CVE-2024-55591 per Fortinet advisory
- Veeam Backup & Replication fix for CVE-2023-27532
- Block vulnerable ThrottleStop driver (CVE-2025-7771) via Microsoft vulnerable driver blocklist
Immediate actions
- Patch FortiOS/FortiProxy for CVE-2024-55591, restrict management interfaces to trusted networks, and rotate all FortiGate and VPN credentials
- Enforce MFA on all VPN and privileged accounts
- Hunt for unexpected GPO changes, files on NETLOGON/SYSVOL, and scheduled tasks named gentlemen_system, UpdateUser, UpdateSystem
- If active: unlink the malicious GPO, disable compromised Domain Admin accounts, isolate network segments, block SMB, and physically isolate backups and snapshots
- Block known C2/exfiltration infrastructure and alert on README-GENTLEMEN.txt creation
Workarounds
- Disable internet-facing FortiGate administrative interfaces
- Disable or restrict AnyDesk and other unmanaged remote access tools via application control
Longer-term hardening
- Deploy EDR with tamper protection and driver-load monitoring; enable Windows vulnerable driver blocklist / HVCI
- Keep offline, immutable backups and protect Veeam and hypervisor management credentials
- Alert on GPO modification, Defender exclusion changes, mass service stops, shadow copy deletion and event log clearing
- Monitor for Rclone/WinSCP/MinIO Client/Restic egress and remote admin tools (AnyDesk, Datto RMM, Cloudflared) not in the approved software baseline
CVEs associated with Gentlemen Ransomware (Storm-2697)
CVE-2024-55591, CVE-2025-7771, CVE-2023-27532, CVE-2024-37085, CVE-2025-32463, CVE-2025-70795, CVE-2025-32433, CVE-2025-33073
Weaknesses (CWE) in Gentlemen Ransomware (Storm-2697)
Timeline of Gentlemen Ransomware (Storm-2697)
Showing the 20 most recent tracked events.
- Handle 'hastalamuerte' opens a RAMP arbitration against Qilin over a reported commission dispute, marking the split that preceded the Gentlemen RaaS (per Group-IB)
- Trend Micro publishes the first detailed public analysis of an August 2025 Gentlemen intrusion (FortiGate access, All.exe/Allpatch2.exe, ThrottleBlood.sys, GPO/NETLOGON deployment)
- ESXi-specific locker released (per Group-IB); the operation moves to an affiliate model in September 2025
- Locker updated with a background execution timer and more aggressive WMI-based spreading (per Group-IB)
- Safetica phase 1 mitigation (February 2026, month-level) restricts the ProcessMonitorDriver IOCTL interface to LocalSystem callers.
- Alleged internal leak of Gentlemen operator data reported in early February 2026 (unconfirmed, per LevelBlue)
- Q1 2026 closes with 166 claimed victims, third place globally, up from 40 in Q4 2025 (Check Point Research, cited by Acronis).
- NVD publishes CVE-2025-70795 (Safetica STProcessMonitor insufficient IOCTL caller validation; NVD CVSS 3.1 5.5, Safetica rates 4.4).
- Check Point-sourced reporting reveals a SystemBC C2 server tied to a Gentlemen affiliate listing 1,570+ likely corporate victims.
- Safetica phase 2 mitigation (May 2026, month-level) removes the vulnerable IOCTL functionality and moves process enforcement to a separate Windows service.
- May 2026 (month-level): breach of the group's internal infrastructure leaks Rocketchat communications; Acronis says the evidence links leadership to the Qilin ecosystem.
- May 2026 (month-level): Safetica Feature Release 11.34.6 ships driver 11.34.5.0, which fully remediates CVE-2025-70795 abused by GentleKiller.
- Sale of the leaked internal database (acknowledged by the administrator on 2026-05-04) is announced for 10,000 USD.
- LevelBlue reports 352 claimed attacks on the leak site in 2026 and an estimated 1,570+ actual compromises
- Intel 471 publishes its report describing Gentlemen as an evolving, stealth-focused double-extortion operation targeting healthcare, manufacturing, technology and professional services
- June 2026 (month-level): reporting says The Gentlemen overtakes Qilin as the most active ransomware group; Safetica Cumulative 11.30.35 released the same month.
- ProvenData reports 965 claimed victims across 90 countries, with 128 new claims in the preceding month
- Microsoft begins blocking Safetica driver 11.11.4.0 and older.
- Acronis TRU publishes its analysis of the group's BYOVD EDR killers (Safetica CVE-2025-70795, Lenovo BootRepair.sys), encryptor and TTPs, citing 800+ claimed victims and 100+ per month.
- Planned date for Microsoft to block Safetica driver 11.26.18.0, the version used by the EDR killer.
Update history for TL-2026-3832
- 2026-10-22 — Gentlemen Ransomware (RaaS) Disables Microsoft Defender, Destroys Backups and Uses BYOVD EDR Killer (CVE-2025-70795): What changed No change to severity (HIGH), exploitability (ACTIVE) or status (ACTIVE); the record is enriched with Check Point Research-sourced intelligence on top of the Acronis TRU material already incorporated. New indicators (11) 3 Gent
- 2026-10-21 — The Gentlemen RaaS: double-extortion ransomware using BYOVD EDR killers (CVE-2025-70795): What changed No severity/exploitability/status change: the record already carries HIGH / ACTIVE. The update adds a second BYOVD driver vulnerability (CVE-2025-70795) and corroborates the existing picture of the group. New indicators (30) 18
Sources cited for Gentlemen Ransomware (Storm-2697)
- Gentlemen Ransomware - Intel 471
- Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed - Trend Micro
- How Hastalamuerte Operates: Group-IB's Analysis of The Gentlemen's Attack Methods
- A Closer Look at The Gentlemen's Alleged Leak - LevelBlue SpiderLabs
- 'The Gentlemen' Rapidly Rises to Ransomware Prominence - Dark Reading
- Gentlemen Ransomware: Tactical Analysis of a High-Velocity RaaS Operation - ProvenData
- The Gentlemen Ransomware - ManageEngine (cites Microsoft Storm-2697 tracking)
- The Gentlemen Ransomware Detection - SOC Prime
- Ransomware: The Gentlemen Ransomware - CUHK ITSC Alert
- The Gentlemen Ransomware With Custom EDR/AV Killers - Cyber Security News
Detection coverage for TL-2026-3832
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3832 across Splunk SPL, Microsoft KQL and Sigma, covering 68 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3832
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.