The Gentlemen ransomware operation (also named by Microsoft as Storm-2697) is actively targeting global enterprise networks by systematically disabling Endpoint Detection and Response (EDR) software.
By blinding host security tools before launching file encryption, this Ransomware-as-a-Service (RaaS) group leaves internal security teams without visibility into active intrusions.
More than 1,570 organizations have been compromised worldwide. Driven by an aggressive 90% affiliate payout model and custom defense-evasion tooling, the group poses an immediate operational threat to critical infrastructure, healthcare, manufacturing, and technology sectors. Uncontained intrusions trigger rapid operational downtime, public data leaks, and severe financial liabilities.
Quick Facts: The Gentlemen Ransomware Operation
|
Who Is Behind The Gentlemen Ransomware Group?
The Gentlemen is a cybercrime splinter group formed by former operators of the Qilin ransomware franchise who broke away following financial disputes over ransom payouts. Led by a threat actor known as hastalamuerte (or Zeta88), the group established its own backend ransomware infrastructure, internally named Rocket.
To rapidly recruit experienced hackers, the administrators introduced an aggressive 90% affiliate payout model. This commission is significantly higher than the traditional 70% to 80% industry standard. The high financial incentive quickly attracted skilled operators displaced by law enforcement actions against legacy ransomware franchises, including LockBit, Black Basta, Embargo, and Medusa.
Source: Lumu’s Tradecraft — track trends, target industries, and countries.
An internal database leak in May 2026 exposed over 3,300 operational chat messages and identified nine core operators managing their infrastructure. While public leak sites display roughly 580 victim organizations, the leaked database revealed over 1,570 compromised corporate environments. This discrepancy indicates that nearly 78% of targeted organizations opt to pay ransoms quietly to avoid public exposure.
Unlike cybercrime groups that focus primarily on North America, The Gentlemen maintains a decentralized geopolitical footprint across Western Europe, South America, and Southeast Asia. However, the group strictly prohibits attacks against entities located in Russia and Commonwealth of Independent States (CIS) nations. This suggests that the group has origins in this region.
Source: Lumu’s Tradecraft — track trends, target industries, and countries.
Which Sectors Face the Highest Risk From The Gentlemen?
The Gentlemen primarily targets critical infrastructure, manufacturing, healthcare, technology, and energy organizations with low tolerance for operational downtime. Encrypting key operational assets in these industries forces executive leadership to face immediate financial losses or pay the ransom.
| Sector | Documented Impact | Security Implications |
| Manufacturing & Agro-Industrial | Over 100 documented victim organizations facing heavy operational disruptions. | Halts physical operations by encrypting Industrial Control Systems (ICS) and production line workstations. |
| Healthcare & Pharmaceuticals | Cases include Hospital Caribbean Medical Center (Puerto Rico), IntraCare (New Zealand), and Unimed Anápolis (Brazil). | Threatens patient safety by paralyzing Electronic Health Records (EHR) and exfiltrating Protected Health Information (PHI). |
| Technology & E-Commerce | High-profile targets include financial service portals and e-commerce platforms like Mercado Libre. | Exposes organizations to secondary extortion via stolen databases, even while public websites stay online. |
| Energy Infrastructure & Utilities | Intrusions include a major power producer in Romania and South American energy leaders like Ecopetrol. | Critical indirect risks to Supervisory Control and Data Acquisition (SCADA) systems controlling energy grids. |
| Construction & Logistics | Incursions against global engineering firms demonstrate a pattern of targeting project management hubs. | Stalls large-scale infrastructure projects by disrupting logistics inventories and engineering blueprints. |
How Do The Gentlemen Gain Initial Access and Reconnaissance?
Affiliates of The Gentlemen gain initial access by combining stolen credentials purchased from Initial Access Brokers (IABs) with public exploits targeting exposed edge appliances (internet-facing devices like firewalls and VPN gateways). Once inside, operators rapidly map the target environment before launching ransomware binaries.
The group systematically monitors perimeter security disclosures for newly revealed flaws in internet-facing devices. In recent campaigns, security analysts have observed Storm-2697 operators actively exploiting four specific Common Vulnerabilities and Exposures (CVEs are unique tracking IDs assigned to publicly known software bugs):
- CVE-2024-55591: Authentication bypass flaw in Fortinet FortiOS and FortiProxy systems, used to directly compromise Virtual Private Network (VPN) firewalls.
- CVE-2025-32433: Vulnerability in Erlang/OTP SSH servers that allows remote code execution on management consoles.
- CVE-2025-33073: Flaw in the Windows Server Message Block (SMB) client exploited to compromise internal network communications and escalate access privileges.
- CVE-2025-55182: Flaw in the React2Shell remote administration tool used to establish persistent Command and Control (C2) interactive channels.
Early campaign phases rely on a custom loader called CountLoader to deploy Cobalt Strike beacons (tools used by attackers to maintain remote control). Security analysts track these intrusions by monitoring active C2 infrastructure, including IP address 91.107.247[.]163.
After establishing a foothold, operators perform extensive Active Directory reconnaissance (mapping the central server that controls corporate user accounts and permissions). Attackers deploy legitimate network administration utilities like Advanced IP Scanner to locate Network-Attached Storage (NAS) devices and VMware ESXi servers. Using automated batch scripts like 1.bat, intruders query over sixty user accounts, targeting high-privilege groups such as Domain Admins and network access roles before executing payloads.
How Does GentleKiller Bypass Endpoint Security Defenses?
The Gentlemen neutralizes corporate security software using GentleKiller, a centrally maintained framework designed to disable Endpoint Detection and Response (EDR) software.
Unlike traditional Ransomware-as-a-Service (RaaS) operations that force affiliates to source their own evasion tools, The Gentlemen’s administration continuously updates and supplies GentleKiller to all members.
GentleKiller operates through a technique known as Bring Your Own Vulnerable Driver (BYOVD). BYOVD is when attackers install legitimate, digitally signed operating system drivers that contain known security flaws into a target system. Because system drivers run at the highest privilege level (Kernel-mode or Ring 0), the malware exploits these driver vulnerabilities to manipulate core memory. This allows GentleKiller to terminate user-mode (Ring 3) security agents and silence alert telemetry before launching file encryption.
| GentleKiller Variant | Abused Driver (BYOVD) | Obfuscation / Packing Type | Targeted Security Defenses |
| Kaspersky Variant (Kasps.exe) | eb.sys (Custom rootkit driver) | Internal code obfuscation and firmware packing. | Forces the disabling and removal of enterprise antivirus solutions. |
| FACEIT Variant (FaceIT1.exe) | nseckrnl.sys (NSecsoft kernel driver) | Enigma Protector commercial packing. | Employs commercial code packing and forged digital signatures to evade heuristic detection. |
| Valorant Variant (Valorant2.exe) | vgk.sys (Anti-cheat driver) | Themida commercial packing. | Modifies internal operating system structures to bypass static file scanners. |
| Javelin Variant (EASolo2Light.exe) | Safetica Driver | Unpacked, fake signature and metadata. | Neutralizes Data Loss Prevention (DLP) tools and user activity auditing software. |
The group also integrates third-party evasion utilities, including HexKiller, HavocKiller, and ThrottleBlood. By running ThrottleBlood alongside the All.exe utility to load ThrottleBlood.sys, operators systematically terminate over 400 distinct security processes on targeted systems.
For local credential scraping, affiliates deploy a specialized utility called OxideHarvest, developed and maintained exclusively by internal developers.
How Does Storm-2697 Align With the MITRE ATT&CK Framework?
The Gentlemen maps to the MITRE ATT&CK framework across eleven primary tactics, focusing heavily on perimeter exploitation, automated Active Directory discovery, and EDR impairment. By tracking these specific Tactics, Techniques, and Procedures (TTPs), security teams can identify and disrupt campaigns at multiple stages of the attack lifecycle.
The following matrix highlights the primary technical behaviors exhibited by Storm-2697 operators:
| MITRE Tactic | Technique / ID | Specific Group Behavior |
| Initial Access | Exploit Public Application (T1190) / Valid Accounts (T1078) | Exploits perimeter flaws (Fortinet, cPanel) and abuses stolen VPN credentials from initial access brokers. |
| Execution | PowerShell (T1059.001) / Scheduled Tasks (T1053.005) | Runs commands to modify Defender exclusion lists, launch loaders, and automate ransomware binaries. |
| Persistence | Remote Access Software (T1219) | Installs administrative tools like AnyDesk and PuTTY to maintain persistent backdoor channels. |
| Privilege Escalation | Process Injection (T1055) / Local Exploits (T1068) | Injects Cobalt Strike DLLs into explorer.exe and uses utilities like PowerRun for SYSTEM access. |
| Defense Evasion | Impair Defenses (T1562.001) / Clear Event Logs (T1070.001) | Deploys GentleKiller to disable EDR agents, clears Windows event logs using wevtutil.exe, and obfuscates Go binaries. |
| Credential Access | OSCredential Dumping (T1003.001) | Extracts domain user hashes from LSASS memory using Mimikatz and scrapes browser password stores. |
| Discovery | Network Service Discovery (T1046) / Domain Groups (T1069.002) | Uses 1.bat and Advanced IP Scanner to enumerate network shares, ESXi hosts, and Domain Admin accounts. |
| Lateral Movement | Remote Services (T1021.001/002) / Group Policy (T1484.001) | Moves via RDP and PsExec, modifying Group Policy Objects (GPO) to push ransomware across network shares. |
| Command & Control | Web Protocols (T1071.001) / Proxy (T1090) | Routes Cobalt Strike and SystemBC beacon traffic over encrypted HTTPS channels and SOCKS proxies. |
| Exfiltration | Exfiltration Over Encrypted Non-C2 Protocol (T1048.002) | Transfers sensitive corporate files over encrypted SFTP channels using WinSCP prior to encryption. |
| Impact | Data Encrypted for Impact (T1486) / Inhibit System Recovery (T1490) | Deletes Volume Shadow Copies via vssadmin.exe and executes Go-based hybrid file encryption. |
Where Can Security Teams Find The Gentlemen Indicators of Compromise (IoCs)?
Security teams can access verified The Gentlemen Indicators of Compromise (IoCs) on the Lumu Threat Observatory, in Lumu Maltiverse. This live threat feed includes up-to-date telemetry-corroborated intelligence, giving you a tactical advantage.
Operating as an interactive threat intelligence radar, the Lumu Threat Observatory provides continuous, real-time tracking of The Gentlemen ransomware group’s global infrastructure. Security analysts can use these live feeds to conduct proactive threat hunting, update perimeter blocklists, and verify whether internal network traffic has interacted with known adversary nodes.
How Can Organizations Defend Against Storm-2697?
Defending against The Gentlemen requires implementing continuous network monitoring that operates independently of local endpoint security agents. Because GentleKiller specifically disables user-mode EDR software, organizations cannot rely solely on host-based alerts.
Security teams should organize their defenses around two primary objectives:
Enforce Essential Endpoint & Identity Controls
- Audit and Block Vulnerable Drivers: Apply Microsoft’s Vulnerable Driver Blocklist across all enterprise endpoints to neutralize the BYOVD drivers exploited by GentleKiller. Organizations can use Lumu Discover to continuously map unmanaged assets and exposed management interfaces before vulnerable drivers can be weaponized.
- Enforce Zero Trust Credential Hygiene: Mandate phishing-resistant Multi-Factor Authentication (MFA) across all remote access portals and Virtual Private Network (VPN) gateways as part of a comprehensive Zero Trust strategy.
- Harden Active Directory and Internal Shares: Restrict lateral movement by disabling SMBv1, enforcing strict Server Message Block (SMB) signing, and isolating user workstations from critical server subnets.
Establish Independent Network-Level Visibility
- Map and Strengthen External Attack Surfaces: Automatically monitor your perimeter to identify exposed internet-facing VPN portals, unpatched interfaces, and leaked credentials before threat actors exploit them for initial access. Lumu Discover provides continuous visibility across your entire external exposure zone to close these entry points proactively.
- Assess Internal Network Compromise in Real Time: Continuously analyze network metadata and gateway logs to catch active intrusions independently of host-based security tools. Operating outside the endpoint, Lumu Defender identifies unauthorized lateral movement, Active Directory probing, and Command and Control (C2) traffic even if local EDR agents have been disabled by GentleKiller.
Defending against The Gentlemen requires moving beyond sole reliance on host-based EDR agents. Because Storm-2697 routinely blinds endpoint tools, organizations must pair strict credential hygiene with independent network visibility to detect intrusions early and halt encryption before operational damage occurs.