Threat actor · G1058

The Gentlemen

Also known as Storm-2697, GOLD SHERWOOD.

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.

ATT&CK techniques

17 mapped

T1018 T1027.002 T1036 T1036.001 T1036.005 T1068 T1078 T1190 T1219.002 T1486 T1583.001 T1585 T1585.001 T1588.002 T1657 T1683.001 T1683.002