The Gentlemen: threat actor profile

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). (MITRE ATT&CK, G1058)

Also known as: Storm-2697, GOLD SHERWOOD

Attacks we reported

1. Oct 29, 2026 Unit 42 Warns Retailers of Peak Season Cyber Threats

17 techniques MITRE has documented for this group

1. Resource Development Acquire Infrastructure: Domains T1583.001 · Establish Accounts T1585 · Establish Accounts: Social Media Accounts T1585.001 · Obtain Capabilities: Tool T1588.002 · Generate Content: Written Content T1683.001 · Generate Content: Audio-Visual Content T1683.002
2. Initial Access Valid Accounts T1078 · Exploit Public-Facing Application T1190
3. Persistence Valid Accounts T1078
4. Privilege Escalation Exploitation for Privilege Escalation T1068 · Valid Accounts T1078
5. Stealth Obfuscated Files or Information: Software Packing T1027.002 · Masquerading T1036 · Masquerading: Invalid Code Signature T1036.001 · Masquerading: Match Legitimate Resource Name or Location T1036.005 · Valid Accounts T1078
6. Discovery Remote System Discovery T1018
7. Command and Control Remote Access Tools: Remote Desktop Software T1219.002
8. Impact Data Encrypted for Impact T1486 · Financial Theft T1657

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).