The Gentlemen ransomware (aka Storm-2697) is a rapidly expanding RaaS program that emerged from an affiliate of Qilin RaaS. It supports multiple platforms via C and Go variants and uses a wide range of initial access methods including exploitation of vulnerabilities in firewalls, VPNs, and other edge devices, brute force, stolen credentials, and collaboration with initial access brokers. The group employs custom tools such as a Go-based backdoor and an EDR evasion framework called GentleKiller, and may leverage zero-day exploits. Since its official RaaS launch in September 2025, The Gentlemen has dramatically increased its victim count, reaching 580 victims across 77 countries by mid-2026, with a notable focus on manufacturing. The ransomware operators offer affiliates a 90% cut of ransoms, higher than typical RaaS models, aiding rapid recruitment. They have also partnered with BreachForums for affiliate recruitment. Unit 42’s analysis includes detailed recommendations for patching exploited vulnerabilities, monitoring for indicators of compromise, and enforcing network segmentation and credential hygiene.

The Gentlemen ransomware has caused widespread impact with over 580 victims across 77 countries, including critical sectors like manufacturing. Its use of multi-platform ransomware variants and custom tools enables broad targeting and effective defense evasion. The high affiliate payout incentivizes rapid expansion and increased attacks. The ransomware’s ability to exploit multiple initial access vectors and use zero-day vulnerabilities increases the risk of successful intrusions. The operational scale and sophistication pose a significant threat to enterprise organizations’ availability and data integrity.

Unit 42 recommends immediate patching of known exploited vulnerabilities including CVE-2024-55591 (Fortinet FortiOS and FortiProxy), CVE-2025-32433 (Erlang/OTP SSH server), CVE-2025-33073 (Windows SMB Client), CVE-2025-55182 (React2Shell), and CVE-2025-7771 (ThrottleStop.sys driver). Organizations should maintain robust visibility on internet-facing systems such as firewalls, VPNs, and remote access gateways, and audit for prior exploitation indicators. Implement high-severity SIEM alerts for scheduled tasks matching 'gentlemen*'. Enable EDR tamper protection and monitor for unsigned or vulnerable driver loads. Deploy phishing-resistant multi-factor authentication and regularly audit credentials. Enforce strict SMB signing, disable SMBv1, restrict lateral movement, and secure ESXi hosts management interfaces. Monitor for anomalous outbound traffic and behavioral indicators of ransomware activity such as deletion of volume shadow copies. Maintain and validate offline backups for recovery. These mitigations address specific tactics used by The Gentlemen ransomware as detailed by Unit 42.