The Gentlemen
- ID
- G1058
- Associated names
- Storm-2697, GOLD SHERWOOD
- Source
- attack.mitre.org
- MITRE last modified
- 1 Oct 2026
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.[1][2][3][4][5][6][7][8]
Techniques used (17)
- T1018 Remote System Discovery
- T1027.002 Software Packing
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1036.005 Match Legitimate Resource Name or Location
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1219.002 Remote Desktop Software
- T1486 Data Encrypted for Impact
- T1583.001 Domains
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1588.002 Tool
- T1657 Financial Theft
- T1683.001 Written Content
- T1683.002 Audio-Visual Content