# Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment

> The Gentlemen is a Go-based, human-operated ransomware-as-a-service operation active since mid-2025 that exfiltrates data before encrypting Windows, Linux, NAS, BSD and ESXi systems. Intrusions start from compromised FortiGate/VPN access, disable EDR via vulnerable drivers and custom killers, and push the locker domain-wide through Group Policy and NETLOGON.

- **Published:** 2026-10-17T19:08:58Z
- **Last reviewed:** 2026-10-22T00:17:02.455Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3832
- **ID:** TL-2026-3832
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 68 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-7771, CVE-2023-27532, CVE-2024-37085, CVE-2025-32463, CVE-2025-70795, CVE-2025-32433, CVE-2025-33073

## Description

The Gentlemen (tracked by Microsoft as Storm-2697) is a ransomware-as-a-service operation first seen in mid-2025. The first Windows sample was uploaded to VirusTotal on 2025-07-17 and already contained the data leak site URL. Group-IB reports that the alleged administrator, handle 'hastalamuerte', was previously a Qilin affiliate and opened a RAMP arbitration against Qilin on 2025-07-22 over a commission dispute; this origin and the operator identity are attributed by researchers from forum activity and a hardcoded string in the locker and are not confirmed. The program moved to an affiliate model in September 2025 (reported 90/10 affiliate/operator split; Russia/CIS targets banned). Intel 471 describes the operation as stealth-focused, multi-stage and increasingly coordinated, with victims in healthcare, manufacturing, technology and professional services across North America, Europe and Asia. Other reporting adds construction and insurance, with Thailand and the US prominent.

Initial access in documented intrusions came from compromised or exposed FortiGate appliances, VPN credentials without MFA (including brute-forced VPN credentials), exposed admin panels, and exploitation of CVE-2024-55591 (FortiOS/FortiProxy authentication bypass). Group-IB reports the operator maintained an inventory of roughly 14,700 compromised FortiGate devices and a list of validated VPN credentials. After access, operators perform discovery with Advanced IP Scanner, SoftPerfect Network Scanner, Nmap, NetExec, BloodHound and similar tools, stage data under C:\PerfLogs and C:\ProgramData\data, create domain accounts, and harvest credentials (LSASS dumping, DPAPI backup key extraction with Impacket dpapi.py and DonPAPI, Veeam credential extraction).

Defense evasion is the group's signature. Operators disable Microsoft Defender with Set-MpPreference and exclusions, and kill EDR/AV with BYOVD: ThrottleStop.sys renamed ThrottleBlood.sys (CVE-2025-7771), plus custom killers All.exe and Allpatch2.exe and the 'GentleKiller' variants using drivers such as nogbc.sys, G11.sys and dmx.sys (one report counts at least eight variants terminating 400+ security processes across 48 vendors). PowerRun is used for privilege escalation, PsExec, AnyDesk, Datto RMM, Cobalt Strike, SystemBC (SOCKS5 proxy) and Cloudflared/Chisel tunnels for lateral movement and remote access. Persistence and execution use scheduled tasks named gentlemen_system, UpdateUser and UpdateSystem. Registry changes weaken NTLM restrictions and RDP security.

The locker pushes mass deployment by modifying Group Policy and staging the binary on the domain NETLOGON share, then forcing gpupdate. Its --spread mode attempts up to 21 distinct remote execution techniques against each reachable host. Before encryption it stops database, backup and virtualization services (MSSQL, MySQL, Oracle, PostgreSQL, Veeam, Acronis, Hyper-V and others), deletes shadow copies (vssadmin, wmic), clears Windows event logs and empties the Recycle Bin. The Go encryptor (Garble-obfuscated per Microsoft) uses per-file ephemeral Curve25519 keys with XChaCha20, requires an 8-byte --password argument, supports partial-encryption speed modes (default ~27%, --fast ~9%, --superfast ~3%, --ultrafast ~0.9%), appends a random six-character extension (e.g. .7mtzhh, .umc16h, .ojuopo) and drops README-GENTLEMEN.txt. An ESXi locker was released on 2025-09-10 and a VMware-destruction PowerShell script (VCENTER.ps1) was observed in operator materials.

Data is exfiltrated before encryption using Rclone (reported renamed avastrclone.exe, to SFTP such as 194.87.31.69:2222 or to Wasabi/MEGA), WinSCP, Restic and MinIO Client. Victims are given roughly 10 days before publication and are directed to Tox or an onion site. Claimed victim counts grew rapidly: ~94 organizations by late 2025 per Group-IB, 352 claimed attacks by 2026-05-10 per LevelBlue, and 965 victims across 90 countries by October 2026 per ProvenData. A May 2026 breach of the 4VPS hosting provider leaked internal chat logs and credentials, and an alleged internal leak was reported in February 2026 (unconfirmed). The article underlying this record (Intel 471) names no CVEs or IOCs; the technical details here are drawn from the cited third-party analyses.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.002 Valid Accounts: Domain Accounts
- T1110.001 Brute Force: Password Guessing
- T1003.001 OS Credential Dumping: LSASS Memory
- T1046 Network Service Discovery
- T1087.002 Account Discovery: Domain Account
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1569.002 System Services: Service Execution
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1219 Remote Access Tools
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1074.001 Data Staged: Local Data Staging
- T1048 Exfiltration Over Alternative Protocol
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1562.004 Disable or Modify System Firewall
- T1070.003 Clear Command History
- T1222.001 Windows File and Directory Permissions Modification
- T1135 Network Share Discovery
- T1083 File and Directory Discovery
- T1018 Remote System Discovery
- T1570 Lateral Tool Transfer
- T1486 Data Encrypted for Impact
- T1561.001 Disk Content Wipe
- T1491.001 Internal Defacement
- T1133 External Remote Services
- T1003.003 OS Credential Dumping: NTDS
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1068 Exploitation for Privilege Escalation
- T1090 Proxy
- T1573 Encrypted Channel

## Sources

- [Gentlemen Ransomware - Intel 471](https://www.intel471.com/blog/gentlemen-ransomware)
- [Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed - Trend Micro](https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html)
- [How Hastalamuerte Operates: Group-IB's Analysis of The Gentlemen's Attack Methods](https://www.group-ib.com/blog/hastalamuerte-gentlemen-raas-ttps/)
- [A Closer Look at The Gentlemen's Alleged Leak - LevelBlue SpiderLabs](https://www.levelblue.com/blogs/spiderlabs-blog/a-closer-look-at-the-gentlemens-alleged-leak)
- ['The Gentlemen' Rapidly Rises to Ransomware Prominence - Dark Reading](https://www.darkreading.com/threat-intelligence/gentlemen-rapidly-rise-ransomware)
- [Gentlemen Ransomware: Tactical Analysis of a High-Velocity RaaS Operation - ProvenData](https://www.provendata.com/blog/gentlemen-ransomware)
- [The Gentlemen Ransomware - ManageEngine (cites Microsoft Storm-2697 tracking)](https://www.manageengine.com/malware-protection/adversaries/gentlemen-ransomware.html)
- [The Gentlemen Ransomware Detection - SOC Prime](https://socprime.com/blog/the-gentlemen-ransomware-detection/)
- [Ransomware: The Gentlemen Ransomware - CUHK ITSC Alert](https://www.itsc.cuhk.edu.hk/all-it/information-security/information-security-alerts/ransomware-the-gentlemen-ransomware/)
- [The Gentlemen Ransomware With Custom EDR/AV Killers - Cyber Security News](https://cybersecuritynews.com/gentlemen-ransomware-global-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3832