Summary Points
-
The Gentlemen, emerging in mid-2025 from a dispute within Qilin RaaS, has rapidly escalated as a human-operated, full-spectrum ransomware group claiming over 500 victims across 70+ countries by April 2026, with significant focus on manufacturing, healthcare, and financial sectors.
-
The group’s unique strength lies in its operator-maintained EDR/AV killing infrastructure, including at least eight BYOVD driver variants and integration of third-party evasion tools, enabling advanced defense evasion, worm-like lateral movement, and sophisticated encryption using hybrid Curve25519/XChaCha20 cryptography.
-
Their attack lifecycle involves targeted exploitation of internet-facing devices like FortiGate VPNs, extensive reconnaissance, deployment of custom EDR-killers to disable defenses, lateral movements through 21 methods, and high-volume data exfiltration, culminating in impactful encryption with custom, multi-platform ransomware.
- A major breach of their internal ‘Rocket’ backend in May 2026 exposed operational intelligence, operator identities, victim lists, and toolchains, yet the group maintained resilience, upgrading their malware and infrastructure, posing a tier-1 threat especially to critical infrastructure and industrial sectors globally.
Underlying Problem
In 2026, The Gentlemen emerged as one of the most aggressive and rapidly spreading ransomware groups. Originating from a payment dispute within the Qilin RaaS program in mid-2025, the group evolved into a sophisticated, human-operated Ransomware-as-a-Service (RaaS) operation tracked by Microsoft as Storm-2697. The gang has since targeted over 500 victims across more than 70 countries, primarily focusing on industries like manufacturing, healthcare, and finance, with a notable attack on Australia’s Mackay Sugar. Their success is fueled by advanced infrastructure, including custom EDR/AV killers under the GentleKiller framework, which can terminate security processes across dozens of vendors. This capability allows them to evade detection and quickly propagate their worm-like ransomware, which encrypts files using a hybrid cryptographic scheme and deletes shadow copies to maximize damage. The attack chain involves precise reconnaissance, exploitation of vulnerabilities like FortiGate VPN CVEs, lateral movement, and exfiltration of vast amounts of data before encryption. The leak of their internal database in May 2026 revealed detailed operational data, yet the group dismissed it as a minor setback, demonstrating their resilience and commitment to expanding their operations globally. This activity has been reported by cybersecurity research firms, Microsoft Threat Intelligence, and independent cybersecurity news outlets, highlighting the group’s dangerous capabilities and growing threat landscape.
Potential Risks
The threat posed by “The Gentlemen Ransomware” with its advanced custom EDR/AV killers can target any business, no matter its size or industry. As it scales rapidly across worldwide markets, it exploits vulnerabilities that traditional defenses often overlook. Consequently, your business could suffer severe data loss, operational disruptions, and financial damage. Moreover, malicious actors can evade detection, making attacks more frequent and harder to prevent. In turn, this results in prolonged downtime, compromised customer trust, and costly recovery efforts. Therefore, understanding and defending against such sophisticated threats is essential for safeguarding your company’s stability and future.
Fix & Mitigation
In the evolving landscape of cybersecurity, rapid and effective response is crucial when confronting sophisticated threats like the Gentlemen Ransomware, especially given its ability to swiftly scale across industries worldwide using custom EDR/AV killers. Timely remediation not only limits operational damage but also helps prevent widespread data breaches and financial loss.
Mitigation Strategies
- Immediate Isolation: Segregate affected systems from the network to prevent the spread of ransomware.
- Threat Analysis: Conduct thorough forensic analysis to understand the attack vector and scope.
- Update Security: Deploy the latest patches and updates to close exploited vulnerabilities.
- Real-time Monitoring: Implement continuous monitoring to detect anomalies early on.
Remediation Actions
- Data Backup & Recovery: Restore affected data from secured backups to ensure business continuity.
- Malware Removal: Use specialized tools to eradicate ransomware remnants from infected systems.
- Access Control: Reset passwords and reinforce access policies to prevent further unauthorized entry.
- Threat Sharing: Notify industry partners and information-sharing platforms about the attack to facilitate collective defense.
Continue Your Cyber Journey
Discover cutting-edge developments in Emerging Tech and industry Insights.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
