D
CyberUnattributed

The Gentlemen

Cybercriminal groupTrackedPending verification

Also known as: Storm-2697, GOLD SHERWOOD

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsStorm-2697, GOLD SHERWOOD
ProliferationOrigin country only
MITRE ATT&CK IDG1058High[1]
Capabilities
ATT&CK techniques used17ATT&CK v20.1High[1]
Malware and toolsPsExec, The Gentlemen Ransomware, Wevtutil3 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorRansomware-as-a-service operatorMed[1]
Notes
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. The Gentlemen, Group G1058, MITRE ATT&CK
    Published/updated 2026-09-30 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1058)