The Gentlemen
MISPUnknown
Unknown
Unknown
[The Gentlemen](https://attack.mitre.org/groups/G1058) is a group that maintains the [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)-as-a-service (RaaS). [The Gentlemen](https://attack.mitre.org/groups/G1058) was first observed in mid-2025 who had posed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. [The Gentlemen](https://attack.mitre.org/groups/G1058) has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)
Techniques Used (17)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1018 | Remote System Discovery | - |
| T1027.002 | Software Packing | - |
| T1036 | Masquerading | - |
| T1036.001 | Invalid Code Signature | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1068 | Exploitation for Privilege Escalation | - |
| T1078 | Valid Accounts | - |
| T1190 | Exploit Public-Facing Application | - |
| T1219.002 | Remote Desktop Software | - |
| T1486 | Data Encrypted for Impact | - |
| T1583.001 | Domains | - |
| T1585 | Establish Accounts | - |
| T1585.001 | Social Media Accounts | - |
| T1588.002 | Tool | - |
| T1657 | Financial Theft | - |
Aliases (2)
Related Malware (3)
Metadata
| ID: | 1018 |
| Created: | 07/03/2026 16:00 |
| Updated: | 14/10/2026 04:00 |