The Gentlemen

MISP
Type:
Unknown
Country:
Unknown
First seen:
Unknown
Details:

[The Gentlemen](https://attack.mitre.org/groups/G1058) is a group that maintains the [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)-as-a-service (RaaS). [The Gentlemen](https://attack.mitre.org/groups/G1058) was first observed in mid-2025 who had posed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. [The Gentlemen](https://attack.mitre.org/groups/G1058) has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)

MITRE ATT&CK: View on MITRE
Techniques Used (17)
ID ATT&CK Tactics
T1018 Remote System Discovery -
T1027.002 Software Packing -
T1036 Masquerading -
T1036.001 Invalid Code Signature -
T1036.005 Match Legitimate Resource Name or Location -
T1068 Exploitation for Privilege Escalation -
T1078 Valid Accounts -
T1190 Exploit Public-Facing Application -
T1219.002 Remote Desktop Software -
T1486 Data Encrypted for Impact -
T1583.001 Domains -
T1585 Establish Accounts -
T1585.001 Social Media Accounts -
T1588.002 Tool -
T1657 Financial Theft -
Aliases (2)
Storm-2697 GOLD SHERWOOD
Metadata
ID: 1018
Created: 07/03/2026 16:00
Updated: 14/10/2026 04:00