Search threats, CVEs… ⌘K
← Back to all threat actors

The Gentlemen

Also known as Storm-2697

The Gentlemen is a ransomware-as-a-service operation tracked by Microsoft under the operator name Storm-2697. The service emerged in 2025 and uses a self-propagating Go ransomware payload for Windows. Affiliates combine data theft, encryption, and leak pressure, while the payload supports automated propagation through several Windows remote-execution mechanisms.

How we source and review actor profiles
Motivation
ransomware
First seen
2025-06-01
Last seen
2026-09-09
Sectors
education, transportation, healthcare, financial-services
Status
Active

Threat intelligence assessment

At a glance

The Gentlemen is a ransomware-as-a-service operation whose affiliates use a configurable, self-propagating Windows encryptor written in Go.

Activity timeline

First observed
Around mid-2025
Status
active

Attribution assessment

Operational playbook

Facts

  • Storm-2697 operators manage the ransomware service while affiliates conduct victim intrusions.
  • The program recruits affiliates and initial-access brokers through criminal forums.
  • Each payload requires a build-specific password and exposes flags controlling delay, propagation, share handling, encryption mode, artifact retention, and wiping.

Initial access and identity targets

Targeting, not victimization. Microsoft's report focuses on ransomware behavior and does not assign a single universal initial-access method to every affiliate intrusion.

Capabilities and evasion

Facts

  • The Windows payload is written in Go and obfuscated with Garble.
  • It uses Curve25519 and XChaCha20, fully encrypting small files and encrypting three regions of larger files.
  • Encrypted files receive the .umc16h extension, and affected hosts receive README-GENTLEMEN.txt ransom notes.
  • The payload can disable Microsoft Defender, delete Volume Shadow Copies and Windows event logs, terminate processes and services, and remove forensic artifacts.
  • Self-propagation can use SMB shares, PsExec, WMI, scheduled tasks, services, PowerShell remoting over WinRM, and PowerShell-based WMI.
  • Optional wiping fills free disk space and the payload can delete itself after execution.

Infrastructure patterns

Facts

  • Operators use criminal forums to advertise the service and recruit affiliates or access brokers.
  • The payload is configurable per build and validates a password before carrying out ransomware operations.

Communication and pressure channels

Facts

  • The operation uses a leak site for extortion and criminal forums for recruitment.

Channels

  • README-GENTLEMEN.txt ransom note
  • data-leak site
  • criminal forums

Observed targeting

Targeting, not victimization. The regional and sector summary reflects reported attacks. The live victim table contains leak-site claims and labels them separately from independently confirmed incidents.

Facts

  • Observed sectors include education, transportation, healthcare, and financial services.
  • Reported activity spans North America, South America, Europe, Africa, and Asia.

Defender guidance

Measures

  • Enable cloud-delivered protection, tamper protection, and endpoint detection and response in block mode.
  • Use controlled folder access and restrict unauthorized changes to protected data.
  • Limit administrative SMB, PsExec, WMI, WinRM, service-creation, and scheduled-task activity between hosts.
  • Alert on coordinated deletion of shadow copies and event logs, Microsoft Defender impairment, and mass file renaming to .umc16h.
  • Maintain tested offline or immutable backups and isolate affected systems quickly to contain automated propagation.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimAir Canada listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPharmaEssentia Corporation listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: onion.

First listed
Victim claimSuperstore listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAbacoViaggi listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimEl Carriel listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRitz Safety listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimComin Sac listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBiotipo Jeans listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDomis listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMetro listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimZanini listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimYapı Merkezi listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSoni Dwarkadas Virchand listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSharp Office listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimS A Chile listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimChip7 listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMutant listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimUniversity of San Francisco listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNile Projects Trading listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHollard Insurance Group listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDrogueria Saporiti Sacifia listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLider Aviacao listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimZdrowit listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimVeradigm listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 105 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

The GentlemenCanonical Name
Storm-2697Alias

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Same actor high
The Gentlemen preferred the gentlemen

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

Overlaps: Qilin Same as: the gentlemen

Loading CVEs, techniques, indicators, malware, victims, and activity...