The Gentlemen Ransomware Group: CVEs, Techniques and Tools

Overview

The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.

First tracked: 2025-09-09
Also known as: Storm-2697
Discussed in our reports: France · Gulf summary · Kuwait · Maghreb · Oman · Qatar · Saudi Arabia · Türkiye · UAE

What public reporting says

Also known as: LARVA-368 (PRODAFT tracking name of its lead operator)

Emerged in mid-to-late 2025 after its lead operator fell out with the Qilin affiliate program; the core crew had worked as an affiliate team before that. Research published in June 2026 describes the lead as Russian-speaking, and investigative reporting places the alleged operator in Russia.
It claimed hundreds of victims within months, and its encryptor targets Windows, Linux, NAS and BSD systems.

Gurucul · Barracuda · The Hacker News

Geography: origin and targets

Assessed origin: Russian Federation. Research describes the lead operator as Russian-speaking, and investigative reporting places the alleged operator in Russia. Attribution is uncertain: read it as an assessment, not proof.

United States of America185
United Kingdom43
France41
Germany40
Thailand40
India35
Italy35
Brazil34
Taiwan, Province of China25
Canada25

Exploited vulnerabilities

Vendor	Product	CVE	Category	Source
Windows	SMB Client	CVE-2025-33073	Microsoft	checkpoint.com
Windows	SmartScreen	CVE-2024-21412	Microsoft	ransom-isac.com, trendmicro.com
Windows	Local Security Authority (LSA)	CVE-2021-36942	Microsoft	security.com, kelacyber.com
Windows	NetLogon	CVE-2020-1472	Microsoft	cisa.gov, cisa.gov, cisa.gov, cisa.gov, cisa.gov, thedfirreport.com, thedfirreport.com, cisa.gov, cisa.gov, welivesecurity.com, cisa.gov, thedfirreport.com, checkpoint.com
MS Server Products	SMBv1	CVE-2017-0144	Microsoft	sentinelone.com, cisa.gov, welivesecurity.com, cisa.gov, kelacyber.com
Fortinet	FortiOS & FortiProxy	CVE-2024-55591	Network edge	esentire.com, forescout.com, s-rminform.com, checkpoint.com, ccb.belgium.be, checkpoint.com
Cisco	Erlang/OTP SSH server	CVE-2025-32433	Network edge	checkpoint.com

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid Accounts	Windows Management Instrumentation	Create Account	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping	Remote System Discovery	Remote Services	Data from Local System	Exfiltration Over Alternative Protocol	Application Layer Protocol	Data Encrypted for Impact
Valid Accounts: Domain Accounts	Command and Scripting Interpreter	Create or Modify System Process	Forced Authentication	Indicator Removal	Brute Force	Network Service Discovery	Remote Services: Remote Desktop Protocol	Data from Network Shared Drive	Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol: Web Protocols	Service Stop
External Remote Services	Command and Scripting Interpreter: PowerShell	Boot or Logon Autostart Execution	Adversary-in-the-Middle	Proxy	Unsecured Credentials	Permission Groups Discovery	Remote Services: SMB/Windows Admin Shares	Data Staged	Transfer Data to Cloud Account	Remote Access Software	Inhibit System Recovery
Exploit Public-Facing Application	Command and Scripting Interpreter: Windows Command Shell			Modify Registry	Credentials from Password Stores	Account Discovery	Remote Services: SSH	Data Staged: Local Data Staging		Protocol Tunneling	Defacement
Phishing	Software Deployment Tools			Domain Policy Modification: Group Policy Modification		Account Discovery: Domain Account	Remote Service Session Hijacking	Email Collection		Encrypted Channel
				Impair Defenses		Domain Trust Discovery
				Impair Defenses: Disable or Modify Tools		Cloud Service Discovery

Technique details

Initial Access (TA0001)

T1078 · Valid Accounts: Use of valid accounts for initial access.
T1078.002 · Valid Accounts: Domain Accounts: Use of valid domain accounts for initial access.
T1133 · External Remote Services: openconnect used to authenticate to FortiGate SSL VPN (--protocol=fortinet). Actors connect post-credential-acquisition to enumerate internal network routes.
T1190 · Exploit Public-Facing Application: Exploitation of public-facing applications for initial access.
T1566 · Phishing: Spear-phishing via compromised corporate OWA mailboxes. ZIP payloads containing LNK files disguised as PDF/DOC/XLS or malicious Office documents sent from legitimate company email accounts to bypass spam filters.

Execution (TA0002)

T1047 · Windows Management Instrumentation: NetExec (nxc) with -X/-x flags for remote PowerShell/CMD execution over WMI/SMB. TrustedSec Titanis used for WMI-based remote execution via NTLM hashes.
T1059 · Command and Scripting Interpreter: Use of command and scripting interpreters for execution.
T1059.001 · Command and Scripting Interpreter: PowerShell: Use of PowerShell for execution.
T1059.003 · Command and Scripting Interpreter: Windows Command Shell: Use of Windows Command Shell for execution.
T1072 · Software Deployment Tools: Ransomware locker and EDR killers deployed domain-wide via GPO (deploy_gpo.ps1). GPO configured to run binaries at startup on all domain-joined machines.

Persistence (TA0003)

T1136 · Create Account: Creation of accounts for persistence.
T1543 · Create or Modify System Process: Velociraptor deployed as a SYSTEM-level Windows service via MSI (Server.Utils.CreateMSI artifact) for persistent beacon access.
T1547 · Boot or Logon Autostart Execution: Boot or logon autostart execution for persistence.

Privilege Escalation (TA0004)

T1068 · Exploitation for Privilege Escalation: Exploitation of vulnerabilities for privilege escalation.
T1187 · Forced Authentication: PetitPotam coercion via NXC coerce_plus module to trigger NTLM authentication from domain hosts toward attacker-controlled relay listener.
T1557 · Adversary-in-the-Middle: Responder (SMB/HTTP disabled) combined with ntlmrelayx targeting LDAP for machine account creation. RelayKing used to scan SMB/LDAP/MSSQL/HTTP/RPC/WinRM relay opportunities.

Defense Evasion (TA0005)

T1027 · Obfuscated Files or Information: Obfuscation of files or information to evade detection.
T1070 · Indicator Removal: Automated post-compromise script clears all Windows Event Logs via wevtutil, removes RDP MRU registry keys, deletes .rdp files, empties Recycle Bin, and clears RDP/SMB/WinRM logs.
T1090 · Proxy: ProxyChains (Windows/Linux), SSH dynamic port forwarding (-NfD 1080), ProxyJump multi-hop pivoting. Self-hosted double-VPN with WireGuard/OpenVPN and Amnezia VPN for operator anonymity.
T1112 · Modify Registry: Modifying the registry for defense evasion.
T1484.001 · Domain Policy Modification: Group Policy Modification: Modification of Group Policy for defense evasion.
T1562 · Impair Defenses: Impairing defenses to avoid detection.
T1562.001 · Impair Defenses: Disable or Modify Tools: BYOVD drivers ($3500-$5000 darknet), EDRStartupHinder, GFreeze/GLinker against CrowdStrike, IFEO registry redirecting EDR processes to calc.exe, WMI GlobalLogger/WPR symlink attacks to overwrite EDR binaries on boot.

Credential Access (TA0006)

T1003 · OS Credential Dumping: XenAllPasswordPro deployed via SMB for mass browser credential harvesting across all hosts. KslDump/KslKatz for LSASS dumping. Velociraptor for full memory dumps without AV detection. Pass-the-Hash via xfreerdp.
T1110 · Brute Force: Custom FortiGate panel bruter on dedicated hardware (dual Xeon, 120GB RAM) targeting non-standard ports. Credential spraying with known default passwords. Hydra for email spraying. Hash cracking via crackmd5.ru and chamd5.org.
T1552 · Unsecured Credentials: FortiGate configuration files exfiltrated containing plaintext LDAP credentials, local VPN user passwords, and IPSec pre-shared keys. MANSPIDER used to search SMB shares for credential files.
T1555 · Credentials from Password Stores: DumpBrowserSecrets used for browser credential and session cookie theft. Cookies imported via Cookie-Editor extension to hijack authenticated M365/CRM/email sessions.

Discovery (TA0007)

T1018 · Remote System Discovery: gogo internal port scanner across /24 subnets (ports 22,53,80,88,389,443,445,636,3389,1433,5985) with 100 threads and ICMP ping. NetExec for SMB/WinRM/LDAP host enumeration.
T1046 · Network Service Discovery: Discovery of network services.
T1069 · Permission Groups Discovery: BloodHound/CertiHound for AD and AD CS (ESC1-ESC17) enumeration. ADFind and ldapdomaindump for group/permission mapping. PrivHound for LPE vector identification within AD.
T1087 · Account Discovery: Discovery of accounts within the environment.
T1087.002 · Account Discovery: Domain Account: Discovery of domain accounts within the environment.
T1482 · Domain Trust Discovery: Discovery of domain trust relationships.
T1526 · Cloud Service Discovery: AWS S3 buckets and EKS clusters enumerated post-access. Censys, Shodan, ZoomInfo, and c99.nl API used for external recon of VPN endpoints and subdomains.

Lateral Movement (TA0008)

T1021 · Remote Services: Use of remote services for lateral movement.
T1021.001 · Remote Services: Remote Desktop Protocol: Use of RDP for lateral movement.
T1021.002 · Remote Services: SMB/Windows Admin Shares: Use of SMB/Windows Admin Shares for lateral movement.
T1021.004 · Remote Services: SSH: Use of SSH for lateral movement.
T1563 · Remote Service Session Hijacking: Browser session cookies stolen via DumpBrowserSecrets and replayed via Cookie-Editor to hijack authenticated web application sessions (email, M365, CRM portals).

Collection (TA0009)

T1005 · Data from Local System: XenAllPasswordPro HTML credential reports collected per host. SQL database full dumps via phpMyAdmin exported to SFTP. File system enumeration targeting CRM code, backups, and financial data.
T1039 · Data from Network Shared Drive: Collection of data from network shared drives.
T1074 · Data Staged: Staging of collected data prior to exfiltration.
T1074.001 · Data Staged: Local Data Staging: Local staging of collected data prior to exfiltration.
T1114 · Email Collection: Corporate OWA mailboxes accessed via purchased stealer logs (snusbase.com) to harvest internal communications, credentials, and sensitive documents.

Exfiltration (TA0010)

T1048 · Exfiltration Over Alternative Protocol: Exfiltration of data over encrypted channels.
T1048.001 · Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol: Exfiltration over symmetric encrypted non-C2 channels.
T1537 · Transfer Data to Cloud Account: rclone to actor-controlled SFTP servers with high-parallelism (--transfers 16 --multi-thread-streams 8 --buffer-size 256M). Observed volumes: 13GB NAS, 3+TB Docker/Nexus, 100+GB Confluence/JIRA.

Command and Control (TA0011)

T1071 · Application Layer Protocol: Use of application layer protocols for C2 communication.
T1071.001 · Application Layer Protocol: Web Protocols: Use of web protocols for C2 communication.
T1219 · Remote Access Software: Use of remote access software for C2.
T1572 · Protocol Tunneling: SSH dynamic SOCKS proxies (ssh -NfD 1080) for network pivoting. ProxyChains (Windows/Linux) tunneling attack tools through SOCKS5 proxies acquired from spam/malware affiliates.
T1573 · Encrypted Channel: Cloudflare Tunnels blend C2 with legitimate HTTPS traffic. Chisel-ng (Rust, SSH-over-WebSocket-over-TLS) for reverse tunnels. Velociraptor C2 over TLS with signed MSI beacons.

Impact (TA0040)

T1486 · Data Encrypted for Impact: Encryption of data for extortion.
T1489 · Service Stop: Stopping services to maximize impact.
T1490 · Inhibit System Recovery: Veeam backup jobs stopped and tape media long-erased (Erase-VBRTapeMedium -Long). Docker and QEMU VMs killed pre-encryption. vCenter used to reset ESXi root passwords. Database services (MySQL, PostgreSQL, MongoDB, Redis, MSSQL) stopped before encryption.
T1491 · Defacement: Data deleted from CRM web panels and databases. chmod -R 777 applied to NAS filesystems to facilitate locker access and destroy access controls.

Tools

Credential theft

DumpBrowserSecrets
Hydra
KslDump
KslKatz
XenAllPasswordPro

Defense evasion

EDRStartupHinder
GFreeze
GLinker

Discovery

ADFind
BloodHound
Censys
CertiHound
MANSPIDER
PowerZure
Shodan
gogo scanner
ldapdomaindump

Exfiltration

rclone

Networking and tunnelling

Chisel-ng
ProxyChains
Tor / Onion C2
openconnect

Offensive tooling

Custom Go Locker (Windows/Linux/NAS)
NetExec (nxc)
PetitPotam
PrivHound
RegPwn
RelayKing
Responder
TrustedSec Titanis
Velociraptor
ZeroPulse
ntlmrelayx

Remote management tools

AnyDesk

Leak-site infrastructure

Title	Type	Address (defanged)	Seen online at snapshot
Gentlecloud Protection	DLS	`tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad[.]onion`	Yes
—	DLS	`i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid[.]onion`	No

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-11