The Gentlemen went from a closed ransomware crew in mid-2025 to one of the most active ransomware-as-a-service programmes of 2026, with an encryptor built to spread itself across a domain once an affiliate has administrator credentials. MITRE ATT&CK added the group (G1058) and its ransomware (S9051) in September 2026 with more than 40 mapped techniques, drawing on reporting from Microsoft, Unit 42, Check Point, Huntress, ESET, Sophos, Intel 471 and Trend Micro. This profile covers the group's names and model, its targeting, the techniques ATT&CK records, its dependence on domain credentials and Group Policy, and the detections and hardening that break its playbook. It is for SOC analysts, incident responders and Active Directory and virtualisation administrators, and builds on the Ransomware Groups Guide.
Key takeaways
- A fast-growing RaaS with generous terms. Unit 42 reports a 90% affiliate payout, 580 claimed victims across 77 countries by 7 July 2026, and ranks it second among RaaS programmes in 2026 by victim count.
- Domain-wide deployment is the defining behaviour. ATT&CK records Group Policy modification on domain controllers and use of the NETLOGON share to distribute the payload to every domain-joined system.
- The encryptor propagates with your credentials. Microsoft reports a module that reuses the current session or supplied credentials and attempts many remote execution methods per host over SMB, scheduled tasks, services, WinRM and WMI.
- Defences are switched off first. ATT&CK and Unit 42 record an EDR killer framework (GentleKiller) using vulnerable drivers, Defender disabled, firewall rules changed, SMB1 re-enabled and logs cleared.
- Hypervisors are in scope. Lockers cover Windows, Linux, NAS, BSD and ESXi, and ATT&CK records ESXi administration commands and clean shutdown of virtual machines.
Who they are (names and aliases)
ATT&CK v20 tracks the group as The Gentlemen (G1058), with the associated names Storm-2697 (Microsoft) and GOLD SHERWOOD (Sophos). ATT&CK describes the group as first observed in mid-2025 as a closed ransomware operation that opened to affiliates in September 2025. The ransomware is tracked separately as The Gentlemen Ransomware (S9051), written in Go and obfuscated with Garble on Windows; Unit 42 notes encryptors in both C and Go.
| Date | Milestone | Source |
|---|---|---|
| July 2025 (at least) | Activity observed; public reporting suggests earlier activity as an affiliate of Qilin | Unit 42 |
| September 2025 | Opens a RaaS programme to affiliates | ATT&CK; Microsoft |
| First half of 2026 | Victim claims slightly more than six times those of the second half of 2025 | Unit 42 |
| May 2026 | Partnership with the BreachForums marketplace to recruit affiliates, penetration testers and access brokers; an alleged insider leaks an internal database | Unit 42; Microsoft |
| June 2026 | Highest month, 117 claimed victims | Unit 42 |
| September 2026 | Added to MITRE ATT&CK as G1058 and S9051 | ATT&CK |
The reported Qilin connection means intrusions may resemble the Qilin Threat Actor Profile. Victim counts come from leak site tracking and include only victims the group chose to publish.
Targeting and motivation
The motive is financial, through double extortion: data theft, encryption and threatened publication (ATT&CK T1657). Microsoft reports victims in education, transportation, healthcare and financial services across North America, South America, Europe, Africa and Asia. Unit 42 counts manufacturing as the largest single sector, with 103 victims, and links it to the sector's need for uptime. Targeting is affiliate-driven and opportunistic: whoever holds an access path, whether a vulnerable edge device, a stolen VPN credential or a purchased foothold, chooses the victim.
Tactics and techniques (MITRE ATT&CK)
The table selects the techniques from G1058 and S9051 that matter most to defenders. All IDs were checked against ATT&CK v20, which records more than 40 techniques across the two entries.
| Tactic | Technique (ATT&CK v20) | Recorded behaviour |
|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application; T1078 Valid Accounts | Vulnerable public-facing devices and services; compromised user credentials |
| Command and control | T1219.002 Remote Desktop Software | Remote access tools such as AnyDesk to keep access |
| Discovery | T1018 Remote System Discovery; T1482 Domain Trust Discovery | Internal network scanners; Active Directory domain details |
| Privilege escalation and defence impairment | T1068 Exploitation for Privilege Escalation; T1588.002 Tool; T1685 Disable or Modify Tools | GentleKiller and other vulnerable driver tools to terminate EDR; Defender real-time protection disabled |
| Stealth | T1564.012 File/Path Exclusions; T1036.001 Invalid Code Signature; T1027.002 Software Packing | Own executable added to antivirus exclusions; copied signatures; Themida or Enigma packing |
| Defence impairment | T1686.003 Windows Host Firewall; T1689 Downgrade Attack; T1685.005 Clear Windows Event Logs | Firewall rules opened for discovery; SMB1 re-enabled; system, application and security logs cleared |
| Deployment | T1484.001 Group Policy Modification; T1037.003 Network Logon Script | Group Policy changed on domain controllers; payload distributed through the NETLOGON share |
| Lateral movement and execution | T1021.002 SMB/Windows Admin Shares; T1047 Windows Management Instrumentation; T1053.005 Scheduled Task; T1564.001 Hidden Files and Directories | Payload staged on a hidden SMB share and run remotely by several methods |
| Persistence | T1547.001 Registry Run Keys; T1037.004 RC Scripts | Run keys on Windows; RC scripts on ESXi |
| Virtualisation | T1675 ESXi Administration Command; T1059.012 Hypervisor CLI; T1529 System Shutdown/Reboot | ESXi commands and clean shutdown of running virtual machines before encryption |
| Impact | T1490 Inhibit System Recovery; T1486 Data Encrypted for Impact; T1561.001 Disk Content Wipe | Shadow copies deleted; Curve25519 and XChaCha20 encryption; free space wiping |
Microsoft reports that files up to 1 MB are fully encrypted and larger files are encrypted in three chunks, which speeds encryption and makes partial recovery of large files unlikely.
How they abuse identities and credentials
- Domain admin is the force multiplier: modifying Group Policy and writing to NETLOGON both require privileged directory rights. Once an affiliate holds those, every domain-joined machine becomes a target in one step. See the Group Policy Security Guide.
- Session reuse: Microsoft reports the propagation module can reuse the current session token or accept supplied credentials, so the encryptor spreads with whatever privilege the launching account holds.
- Stolen and brokered credentials: Unit 42 lists leaked or stolen credentials, brute force and initial access brokers among entry methods, and recommends phishing-resistant MFA and regular rotation.
- Edge devices: exploitation of firewalls and VPNs often yields credentials or sessions as well as code execution. See the Edge Device Exploitation by Threat Actors Guide.
- Virtualisation admins: ESXi and vCenter access lets an affiliate shut down and encrypt whole estates. Unit 42 advises treating virtualisation infrastructure as tier 0.
Notable incidents
No live NHI Mgmt Group breach page is attributed to The Gentlemen at the time of writing. The public record is mainly leak site claims tracked in aggregate (580 victims by July 2026 per Unit 42) and incident response reports such as Check Point's DFIR report and Huntress's analysis of the group's defence evasion. Use the ATT&CK entries as the reference for behaviour, and treat individual leak site claims as unverified until the victim confirms.
Detection and defence
What to monitor
| Signal | Where to find it | Technique |
|---|---|---|
| New or modified GPOs, especially ones adding scheduled tasks, scripts or security setting changes | Directory Service Changes (Event ID 5136); GPO change auditing | T1484.001 |
| New executables written to NETLOGON or SYSVOL | File integrity monitoring on domain controllers; EDR | T1037.003 |
| Kernel loads of known vulnerable or unsigned drivers | Sysmon Event ID 6; Code Integrity log | T1068, T1685 |
| Defender real-time protection disabled or exclusions added | Defender events 5001 and 5007; EDR tamper alerts | T1685, T1564.012 |
| SMB1 re-enabled or firewall rule groups opened | Configuration monitoring; firewall change events | T1689, T1686.003 |
| Security log cleared | Event ID 1102 | T1685.005 |
| Hidden shares created and remote service or task creation across many hosts | Event IDs 5142, 7045, 4698 | T1564.001, T1053.005 |
| SSH enabled or VM power-off bursts on ESXi | ESXi syslog; vCenter events | T1675, T1529 |
Defences that break the playbook
- Protect Group Policy and NETLOGON: limit GPO edit rights to a small tier 0 group, require change tickets, and alert on every GPO change outside a window. Test alerting in a lab domain first.
- Turn on tamper protection and EDR block mode as Microsoft recommends, together with cloud-delivered protection and controlled folder access.
- Enable attack surface reduction rules Microsoft lists, including blocking process creation from PsExec and WMI commands on managed devices and advanced ransomware protection. Run them in audit mode for two weeks, review hits, then enforce by ring.
- Block vulnerable drivers: enable the Microsoft vulnerable driver blocklist and memory integrity. See the Bring Your Own Vulnerable Driver and EDR Killers Guide.
- Harden SMB: disable SMB1 by policy, enforce SMB signing and restrict workstation-to-workstation SMB. See the SMB Signing Guide.
- Patch and monitor edge devices listed in CISA's KEV catalogue, and audit them for prior compromise.
- Isolate the hypervisor tier: SSH off on ESXi by default, separate non-domain admin accounts. See the VMware ESXi Hardening Guide and the ESXi Ransomware Playbook.
- Keep offline, tested backups; rollback for any hardening change is a scoped GPO exception with an owner and expiry.
Metrics
- GPO edit rights: number of accounts able to edit GPOs linked to domain or OU roots (target a small named tier 0 list).
- Unreviewed GPO changes: GPO changes per month without a matching change ticket (target zero).
- Tamper protection coverage: percentage of endpoints with tamper protection and EDR block mode.
- Driver blocklist coverage: percentage of Windows hosts enforcing the vulnerable driver blocklist.
- SMB1 exposure: number of hosts with SMB1 enabled (target zero).
Framework mapping
| Defence | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Restricting GPO and tier 0 rights | PR.AA-05 | AC-6 Least Privilege |
| Secure configuration (SMB1 off, ASR, driver blocklist) | PR.PS-01 | CM-6 Configuration Settings; CM-7 Least Functionality |
| Phishing-resistant MFA for remote access | PR.AA-03 | IA-2 Identification and Authentication |
| Monitoring GPO, driver and tamper events | DE.CM-03 | SI-4 System Monitoring |
| Offline backups | PR.DS-11 | CP-9 System Backup |
Common failure patterns
- Broad GPO delegation: helpdesk or project groups with edit rights on domain-linked GPOs give an affiliate a domain-wide deployment channel from a lower-tier account.
- Tamper protection left off: without it, scripted changes to Defender settings and exclusions succeed silently before encryption.
- Driver blocklist not enforced: EDR killers that rely on known vulnerable drivers work on hosts where the blocklist and memory integrity are disabled for compatibility.
- Legacy SMB tolerated: SMB1 left installable and unsigned SMB allowed between workstations make the propagation module's job easy.
- Hypervisor on the domain: ESXi and vCenter managed with domain admin accounts mean one stolen credential reaches every virtual machine.
Practitioner checklist
- Audit who can edit GPOs and write to NETLOGON and SYSVOL, and reduce to tier 0 only.
- Alert on GPO changes, new files in NETLOGON and hidden share creation.
- Enforce tamper protection, EDR block mode and cloud-delivered protection on all endpoints.
- Pilot and enforce Microsoft's recommended attack surface reduction rules.
- Enable the vulnerable driver blocklist and memory integrity.
- Disable SMB1, enforce SMB signing and restrict lateral SMB.
- Patch KEV-listed edge device flaws and require phishing-resistant MFA on VPN.
- Disable ESXi SSH by default and separate hypervisor admin accounts from the domain.
- Test offline backup restores for both Windows and virtualised workloads.
Standards and references
- MITRE ATT&CK: The Gentlemen (G1058)
- MITRE ATT&CK: The Gentlemen Ransomware (S9051)
- Microsoft Security: The Gentlemen ransomware, dissecting a self-propagating Go encryptor
- Palo Alto Networks Unit 42: The Gentlemen ransomware
- MITRE ATT&CK: Group Policy Modification (T1484.001)
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Ransomware Groups Guide · Group Policy Security Guide · Bring Your Own Vulnerable Driver and EDR Killers Guide · Qilin Threat Actor Profile · ESXi Ransomware Playbook