Search threats, CVEs… ⌘K
← Back to all threat actors

The Gentlemen

Also known as Storm-2697

The Gentlemen is a ransomware-as-a-service operation tracked by Microsoft under the operator name Storm-2697. The service emerged in 2025 and uses a self-propagating Go ransomware payload for Windows. Affiliates combine data theft, encryption, and leak pressure, while the payload supports automated propagation through several Windows remote-execution mechanisms.

How we source and review actor profiles
Motivation
ransomware
First seen
2025-06-01
Last seen
2026-10-27
Sectors
education, transportation, healthcare, financial-services
Status
Active

Threat intelligence assessment

At a glance

The Gentlemen is a ransomware-as-a-service operation whose affiliates use a configurable, self-propagating Windows encryptor written in Go.

Activity timeline

First observed
Around mid-2025
Status
active

Attribution assessment

Operational playbook

Facts

  • Storm-2697 operators manage the ransomware service while affiliates conduct victim intrusions.
  • The program recruits affiliates and initial-access brokers through criminal forums.
  • Each payload requires a build-specific password and exposes flags controlling delay, propagation, share handling, encryption mode, artifact retention, and wiping.

Initial access and identity targets

Targeting, not victimization. Microsoft's report focuses on ransomware behavior and does not assign a single universal initial-access method to every affiliate intrusion.

Capabilities and evasion

Facts

  • The Windows payload is written in Go and obfuscated with Garble.
  • It uses Curve25519 and XChaCha20, fully encrypting small files and encrypting three regions of larger files.
  • Encrypted files receive the .umc16h extension, and affected hosts receive README-GENTLEMEN.txt ransom notes.
  • The payload can disable Microsoft Defender, delete Volume Shadow Copies and Windows event logs, terminate processes and services, and remove forensic artifacts.
  • Self-propagation can use SMB shares, PsExec, WMI, scheduled tasks, services, PowerShell remoting over WinRM, and PowerShell-based WMI.
  • Optional wiping fills free disk space and the payload can delete itself after execution.

Infrastructure patterns

Facts

  • Operators use criminal forums to advertise the service and recruit affiliates or access brokers.
  • The payload is configurable per build and validates a password before carrying out ransomware operations.

Communication and pressure channels

Facts

  • The operation uses a leak site for extortion and criminal forums for recruitment.

Channels

  • README-GENTLEMEN.txt ransom note
  • data-leak site
  • criminal forums

Observed targeting

Targeting, not victimization. The regional and sector summary reflects reported attacks. The live victim table contains leak-site claims and labels them separately from independently confirmed incidents.

Facts

  • Observed sectors include education, transportation, healthcare, and financial services.
  • Reported activity spans North America, South America, Europe, Africa, and Asia.

Defender guidance

Measures

  • Enable cloud-delivered protection, tamper protection, and endpoint detection and response in block mode.
  • Use controlled folder access and restrict unauthorized changes to protected data.
  • Limit administrative SMB, PsExec, WMI, WinRM, service-creation, and scheduled-task activity between hosts.
  • Alert on coordinated deletion of shadow copies and event logs, Microsoft Defender impairment, and mass file renaming to .umc16h.
  • Maintain tested offline or immutable backups and isolate affected systems quickly to contain automated propagation.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimEichstatt listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRegency Park Oak Knoll listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFPT Software listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: onion.

First listed
Victim claimImmoVia Hausverwaltung listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMercantile Investment Corporation Bolivia S A listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSuperScale listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRexville Radiology listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGrundbaulabor Trier listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMann Group listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSAP listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimGroupe AC Environnement listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTrade Union Co listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSOME listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimWABAG listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLydenburg Toyota listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimUnisa Shoes listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimZinkan Enterprises listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMalmsten listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBetopia Group listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAcodafe listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAtlas Stamping Manufacturing listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimEPMMOP listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPure Perfection listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBelmont Resorts listed by The Gentlemen

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 105 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

The GentlemenCanonical Name
Storm-2697Alias

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Same actor high
The Gentlemen preferred the gentlemen

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

Overlaps: Qilin Same as: the gentlemen

Loading CVEs, techniques, indicators, malware, victims, and activity...