The Gentlemen (Storm-2697) is a rapidly ascending Ransomware-as-a-Service (RaaS) operation that has significantly expanded its footprint since mid-2025. Known for offering an industry-leading 90% payout to affiliates, the group utilizes both C and Go-based encryptors to target diverse operating systems and virtualized infrastructures. Their arsenal includes custom backdoors, a specialized EDR killer framework named 'GentleKiller,' and the exploitation of various vulnerabilities in edge devices and internal systems.
As of mid-2026, The Gentlemen has emerged as a major player in the threat landscape, claiming hundreds of victims globally, particularly within the manufacturing sector. Their operational growth is fueled by aggressive recruiting on platforms like BreachForums and the use of sophisticated defense evasion techniques, such as zero-day exploits and tamper protection bypasses. Organizations are advised to prioritize patching critical vulnerabilities and enforcing strict network segmentation to mitigate risk.
Top comments (0)