The Gentlemen
[The Gentlemen](https://attack.mitre.org/groups/G1058) is a group that maintains the [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)-as-a-service (RaaS). [The Gentlemen](https://attack.mitre.org/groups/G1058) was first observed in mid-2025 who had posed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. [The Gentlemen](https://attack.mitre.org/groups/G1058) has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)
Properties
- last_source
- MITRE ATT&CK
- stix_id
- intrusion-set--973abd91-322f-4756-94b6-67381c4089b3
- signal_observed_at
- 2026-10-14T17:10:08+00:00
- retrieved_at
- 2026-10-14T17:10:10+00:00
- type
- intrusion-set
MITRE ATT&CK Techniques (17)
Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse
Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to bui
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. De
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later
Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense
Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent finan
Software & Tools (3)
[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT
[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) is a ransomware-as-a-service (RaaS). [The Gentlemen Ransomware](https://attack.mit
[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event
Explore this actor's full graph with Ninja Signal