No Manners Here: The Ruthless Rise of The Gentlemen Ransomware

1. Executive summary

The Gentlemen (aka Storm-2697) is a Ransomware-as-a-Service (RaaS) program active since at least July 2025, now ranked as the second most active ransomware group by victim count with 580 claimed victims across 77 countries through July 2026. The group operates an affiliate model offering an unprecedented 90% ransom payout, has deployed custom tooling including a Go-based backdoor and an EDR-killer framework dubbed "GentleKiller," and is suspected of using an unspecified zero-day exploit for defence evasion. Attribution to the actor "The Gentlemen" / "Storm-2697" is unconfirmed — no MITRE ATT&CK profile exists for this actor. EMEA financial services organisations face elevated exposure given the group's rapid growth (6x victim increase H2-2025 to H1-2026), multi-platform encryptors (C and Go), and targeting of operational-uptime-dependent sectors.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from source material)

1. Initial access. The Gentlemen uses multiple initial access techniques: exploitation of vulnerabilities in edge devices (firewalls, VPNs), brute-force attacks, use of leaked and/or stolen credentials, and collaboration with initial access brokers (IABs). No specific CVE is identified in the source material.
2. Defence evasion. The group deploys a custom EDR-killer framework dubbed "GentleKiller" to disable endpoint protection. They are also suspected of using an unspecified zero-day vulnerability exploit to amplify defence evasion — this is unconfirmed and single-sourced (Unit 42).
3. Backdoor deployment. A custom Go-based backdoor is deployed for persistent access and remote control.
4. Encryption and impact. Ransomware variants written in both C and Go are deployed across different operating systems and virtual infrastructure. A custom desktop wallpaper is set post-deployment as the ransom notice.

Technical specifics

• Actor aliases: The Gentlemen; Storm-2697 (Unit 42 designation). The group's operators were likely active months earlier as an affiliate of Qilin RaaS under the name ArmCorp. Unit 42 tracks Qilin as Spikey Scorpius and Akira as Howling Scorpius.
• Organisational structure: Approximately 20 operators; transitioned from a private entity to a RaaS model on or about September 2025. An alleged insider leaked an internal database in May 2026.
• Affiliate economics: 90% payout to affiliates (vs. 70–80% industry norm), driving aggressive recruitment.
• Recruitment channels: In May 2026, The Gentlemen announced a partnership with HasanBroker's BreachForums to recruit affiliates, penetration testers, and IABs.
• Encryptor platforms: C and Go — enabling cross-OS and virtual-infrastructure targeting.
• Victimology: 580 total victims claimed across 77 countries since inception (through July 7, 2026). 103 victims in manufacturing. June 2026 was the peak month with 117 claimed victims. Victim count increased ~6x comparing H2-2025 to H1-2026.
• Custom tooling:
• GentleKiller — EDR-killer framework (name confirmed in source).
• Go-based backdoor — custom, specific product name not provided.
• Suspected zero-day: The source references "suspected usage of an unspecified zero-day vulnerability exploit" — no CVE, product, or CVSS data is available. This claim is single-sourced (Unit 42); treat as unconfirmed.

Attribution confidence

Actor "The Gentlemen" / "Storm-2697" has no MITRE ATT&CK profile in the verified reference data. Attribution is unconfirmed. The link to Qilin/ArmCorp is based on public reporting and Unit 42 tracking — treat as probable but not independently verified. The alleged insider leak and the HasanBroker partnership are single-sourced to Unit 42 and DataBreaches.net respectively.

4. Mitigation & containment

P1 — Within 24 hours

• Edge-device hardening: Audit all externally facing firewalls and VPN concentrators for unpatched vulnerabilities. Ensure management interfaces are not internet-exposed. The source confirms edge-device exploitation as a primary initial-access vector.
• Credential hygiene: Force rotation of any credentials known to be exposed in public breach corpora. The group uses leaked/stolen credentials for initial access.
• EDR tamper protection: Enable EDR self-protection / tamper-protection mechanisms to resist the "GentleKiller" framework. Verify EDR agent anti-uninstall features are enforced across all endpoints.
• Brute-force protection: Enforce account lockout thresholds and MFA on all externally accessible authentication surfaces. The group uses brute-force attacks for initial access.
• Threat-hunt kickoff: Hunt for Go-based binaries on endpoints that lack legitimate Go build tooling, particularly in staging or temporary directories.

P2 — Within 72 hours

• Network segmentation review: Validate that critical assets (especially manufacturing/OT-adjacent systems) are segmented from general corporate networks. The group targets operational-uptime-dependent sectors.
• Backdoor detection: Deploy detection rules for unsigned or recently compiled Go binaries exhibiting network beaconing behaviour. The custom Go-based backdoor is a confirmed tool.
• IAB exposure assessment: Review whether any third-party or supplier credentials have been offered on BreachForums or related underground markets. The group actively collaborates with IABs.
• Backup validation: Verify offline/immutable backup integrity and test restoration procedures for both Windows and Linux/virtualised environments, given the dual C/Go encryptor capability.

P3 — Within 7 days

• Zero-day response planning: Establish a process for rapid patch deployment if the unspecified zero-day exploited by The Gentlemen is identified and disclosed. Monitor CISA KEV and vendor advisories.
• Purple-team exercise: Simulate the Gentlemen attack chain: edge-device exploitation → credential abuse → EDR tampering → Go backdoor deployment → multi-platform encryption.
• Underground monitoring: Monitor BreachForums (HasanBroker's section) for organisation-specific mentions, leaked credentials, or IAB listings matching your infrastructure.
• Tabletop exercise: Run a ransomware tabletop incorporating the 90% affiliate-payout economic model — note that affiliates are highly incentivised to negotiate aggressively.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources name tooling ("GentleKiller," Go-based backdoor) and operational details but do not provide file hashes, IP addresses, domains, mutex names, or other machine-readable IOCs.

6. Detection

rule Gentlemen_Ransomware_Tools {
    meta:
        author = "Adverse Trace"
        date = "2026-07-11"
        reference = "https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"
        description = "Detection rule for The Gentlemen ransomware tooling based on named artefacts from Unit 42 reporting"
    strings:
        $gentlekiller = "GentleKiller" ascii nocase
        $gentlemen_wallpaper = "The Gentlemen" ascii nocase
        $storm_id = "Storm-2697" ascii nocase
        $armcorp = "ArmCorp" ascii nocase
    condition:
        2 of them
}

title: Detect Gentlemen Ransomware Go-Based Backdoor Beaconing
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b3c8d2e5f
status: experimental
description: >
    Detects potential Go-based backdoor activity associated with The Gentlemen
    ransomware group (Storm-2697). Based on Unit 42 reporting of a custom
    Go-based backdoor used by the group. This is a behavioural heuristic —
    tune for your environment.
author: Adverse Trace
date: 2026/07/11
references:

    - https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/
logsource:
    product: windows
    category: process_creation
detection:
    selection_go_binary:
        Image|endswith:

            - '.exe'
        CommandLine|contains:

            - '\\Temp\\'
            - '\\AppData\\Local\\Temp\\'
    filter_legitimate_go:
        Image|contains:

            - 'go.exe'
            - 'golang'
    condition: selection_go_binary and not filter_legitimate_go
falsepositives:

    - Legitimate Go-compiled applications in temp directories
    - Development tooling
level: medium

title: Detect EDR Process Tampering Aligned with GentleKiller Framework
id: 8b4d2a3f-5c6e-4f9a-8d2b-1c7e4f9a3b6c
status: experimental
description: >
    Detects attempts to kill or tamper with EDR/AV processes consistent with
    the "GentleKiller" framework attributed to The Gentlemen ransomware group.
author: Adverse Trace
date: 2026/07/11
references:

    - https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/
logsource:
    product: windows
    category: process_creation
detection:
    selection_kill_eds:
        CommandLine|contains|all:

            - 'taskkill'
            - '/F'
            - '/IM'
    target_edr_processes:
        CommandLine|contains:

            - 'MsMpEng.exe'
            - 'MsSense.exe'
            - 'SenseCE.exe'
            - 'CrowdStrike.exe'
            - 'CSFalconService.exe'
            - 'TmPfw.exe'
            - 'TmEndUsr.exe'
    condition: selection_kill_eds and target_edr_processes
falsepositives:

    - Legitimate EDR agent upgrades or troubleshooting
level: high

7. Sources

• Unit 42 (Palo Alto Networks) — "No Manners Here: The Ruthless Rise of The Gentlemen Ransomware" — https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/ — 2026-07-10
• DataBreaches.net — "Who Runs the Ransomware Group 'The Gentlemen?'" — https://databreaches.net/2026/06/10/who-runs-the-ransomware-group-the-gentlemen/ — 2026-06-10
• Graham Cluley / Fortra — "The Gentlemen ransomware: what you need to know" — https://www.fortra.com/blog/gentlemen-ransomware-what-you-need-know — 2026 (exact date not specified)

8. Adverse Trace position

Severity: High. The Gentlemen represents a rapidly escalating ransomware threat with a 6x victim-count increase in six months, 580 claimed victims across 77 countries, and custom multi-platform tooling including an EDR-killer framework and Go-based backdoor. The 90% affiliate payout model is driving aggressive recruitment and will likely sustain or increase attack velocity through 2026. Attribution to "The Gentlemen" / "Storm-2697" is unconfirmed (no MITRE ATT&CK profile); the suspected zero-day exploit is single-sourced and unverified. EMEA financial services clients should prioritise edge-device patching, EDR tamper-protection enforcement, credential-rotation programmes, and monitoring of BreachForums for organisation-specific exposure. We will continue tracking this actor and will issue a supplemental advisory if the unspecified zero-day is identified and assigned a CVE.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.