Article
The Gentlemen Ransomware Claims 38 Victims in One Day
On 26 October 2026 THANOS saw 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what…
Read more
Ransomware group profile
The Gentlemen Ransomware Group
Also known as GOLD SHERWOOD
The Gentlemen is a ransomware-as-a-service operation.
- Active
In short
The Gentlemen is a ransomware-as-a-service operation. Sophos says the scheme started in mid-2025 and posted its first victims to a leak site in September 2025. Unit 42 cites an outside count of 580 claimed victims in 77 countries through 7 July 2026. Check Point says entry is almost always through an unpatched internet-facing device such as a VPN or firewall.
- StatusActiveas reported
- Other Names1names in public reportsGOLD SHERWOOD
- Entry Routes6ways inDisabling security tools · Spreading with Group Policy · Tools used after entry
- Techniques8mapped to MITRE ATT&CKExternal Remote Services · Valid Accounts
- Defences8first steps listedLimit lateral movement · Harden ESXi hosts
Overview
The Gentlemen is a ransomware-as-a-service (RaaS) program. Unit 42 says it has been active since at least July 2025. Sophos says the operator started the scheme in mid-2025 and that the first victims reached a dedicated leak site in September 2025. Trend Micro says it investigated a campaign by the group in August 2025 and called it an emerging and previously undocumented threat group.
Unit 42, citing public reporting, says the operators were likely active months earlier as an affiliate, known as ArmCorp, of Qilin ransomware. Sophos also says the operator was a Qilin affiliate before starting The Gentlemen scheme, and tracks the operator as GOLD SHERWOOD. Unit 42 says typical programs offer affiliates 70% to 80% of paid ransoms, while The Gentlemen offer 90%. Sophos and Check Point also report a 90/10 split.
Counts and ranks differ by source, because each one measures a different period. Check Point says the group had claimed over 320 victims by 20 April 2026, 240 of them in 2026. That made it the second most active group by victim count so far that year. Its Q1 2026 report places the group third for the quarter, with 166 victims.
Unit 42 cites an outside count of 580 claimed victims through 7 July 2026, 103 of them in manufacturing, and calls it the second most active RaaS program of 2026.
Check Point says manufacturing and technology are the most frequently targeted sectors, with healthcare third. It says the USA has the most victims, followed by the UK and Germany.
Its Q1 2026 report adds that only 13.3% of the group’s victims are in the United States, against an ecosystem average of 49.6%. The ransomware.live tracker, read on 27 October 2026, shows the group posting victims in batches. It lists 8 days with 30 or more new listings, and the largest was 41 on 1 July 2026.
Check Point says entry is almost always through an unpatched internet-facing device, such as a VPN or firewall. Sophos says affiliates kept a list of Fortinet FortiGate devices that were vulnerable to CVE-2024-55591, the FortiOS and FortiProxy authentication bypass. Check Point calls the group’s attacks largely opportunistic: it looks for exposed, vulnerable internet-facing systems and uses them as the way in.
The locker runs on Windows, Linux and ESXi, according to Check Point, and Unit 42 says the encryptors are written in C and Go. Check Point’s DFIR report describes an ephemeral X25519 key exchange. Files under 1 MB are encrypted with the XChaCha20 stream cipher, and larger files only in part. About 9 percent of a file is encrypted in fast mode and about 1 percent in ultrafast mode.
Before it encrypts, the Windows locker turns off Microsoft Defender real-time monitoring and adds exclusions. It also disables the firewall, tries to delete shadow copies and clears the event logs. On ESXi, Check Point says it changes VMFS write-buffer settings and turns off virtual machine autostart. Sophos says the program prohibits affiliates from targeting organizations in Russia or the Commonwealth of Independent States.
Also known as
- GOLD SHERWOOD
Timeline
- Mid-2025
Sophos says the operator starts The Gentlemen scheme. Unit 42 says the program has been active since at least July 2025 and, citing public reporting, that the operators were likely active earlier as a Qilin affiliate.
- Aug 2025
Trend Micro investigates a campaign by The Gentlemen, which it calls an emerging and previously undocumented threat group.
- Sep 2025
Sophos says the first victims of the scheme are posted to a dedicated leak site.
- 9 Sep 2025
Trend Micro publishes its report on the group's tactics. It names manufacturing as the hardest hit industry and counts attacks in at least 17 countries.
- Late 2025 to early 2026
Sophos says fewer than 20 victim names a month were posted for the rest of 2025. It says this rose to over 75 a month on average at the beginning of 2026.
- 20 Apr 2026
Check Point Research reports over 320 claimed victims since mid-2025 and publishes a DFIR report on an intrusion involving The Gentlemen and the SystemBC proxy.
- 4 May 2026
The group's administrator acknowledges on underground forums that an internal backend database was compromised and leaked, according to Check Point. The leak includes internal chat logs, rosters and negotiation transcripts.
- 10 Jul 2026
Unit 42 publishes its profile and cites an outside count of 580 claimed victims in 77 countries through 7 July 2026.
- 26 Oct 2026
Brandefense's dark-web monitoring saw 38 leak-site entries for the group relayed in one day. These are claims by the group, relayed by a third-party channel, and Brandefense has not verified them.
How they get in
- 01
Firewalls, VPNs and other edge devices
Unit 42 says affiliates exploit vulnerabilities in edge devices such as firewalls and VPNs, and also use brute force attacks. Check Point says the group deliberately targets internet-facing devices as its entry point. Trend Micro could not confirm the entry vector in the case it investigated, but says an internet-exposed FortiGate server likely served as the entry point.
- 02
Fortinet FortiGate: CVE-2024-55591
Sophos says affiliates kept a list of FortiGate devices, found through reconnaissance, that were vulnerable to CVE-2024-55591. Check Point's Q1 2026 report describes a cache of about 14,700 pre-exploited FortiGate devices, exploited primarily through this flaw. Check Point's analysis of the leak adds CVE-2025-32433 as in active use and CVE-2025-33073 used with NTLM relay.
- 03
Stolen credentials and access brokers
Sophos says affiliates also kept a list of brute-forced credentials for Fortinet VPN access. Unit 42 lists leaked or stolen credentials and initial access brokers as other routes in. Check Point says the group buys access from brokers and uses credentials from infostealer logs.
- 04
Disabling security tools
Unit 42 describes an EDR killer framework called GentleKiller and a custom Go-based backdoor, and suspects an unspecified zero-day exploit. Sophos says affiliates use bring your own vulnerable driver (BYOVD) to raise privileges and end EDR processes. Trend Micro describes ThrottleBlood.sys, a legitimate signed driver used for kernel-level manipulation, and Unit 42 names the ThrottleStop.sys driver flaw, CVE-2025-7771.
- 05
Spreading with Group Policy
Sophos and Check Point say affiliates use Group Policy objects to spread the ransomware. Check Point's DFIR report describes a mode that copies the locker to the NETLOGON share and creates a GPO with a scheduled task that runs as SYSTEM. Another mode lists domain computers and deploys through PsExec, WMI, scheduled tasks and services. The result was a near-simultaneous encryption across the environment.
- 06
Tools used after entry
Trend Micro lists Advanced IP Scanner, Nmap, PsExec, AnyDesk and WinSCP, and the possible use of PuTTY. It says data was likely taken out through WinSCP. Sophos lists AnyDesk, Cobalt Strike, Impacket, SystemBC and OxideHarvest among the tools it ties to the operator. Check Point's DFIR report looks at The Gentlemen together with the SystemBC proxy.
How they extort
Double extortion in effect. Sophos and Trend Micro say the group steals data and encrypts files, then threatens to publish the data of victims who do not pay on its leak site. Check Point's DFIR report says the ransom note opens with "Gentlemen, your network has been encrypted." It tells victims who get no reply within 36 hours to create another account and write again. Negotiation runs through Tox or Session.
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Exploitation for Privilege Escalation Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with. T1068 · Privilege Escalation
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Scheduled Task/Job Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system. T1053 · Execution, Persistence, Privilege Escalation
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
How to defend
-
Patch edge devices and the named flaws first
Unit 42 lists CVE-2024-55591 (FortiOS and FortiProxy), CVE-2025-32433 (Erlang/OTP SSH server), CVE-2025-33073 (Windows SMB Client), CVE-2025-55182 (React2Shell) and CVE-2025-7771 (ThrottleStop.sys driver). Check Point calls edge device patching a board-level priority, and Trend Micro advises virtual patching for VPN concentrators and firewalls.
-
Close remote access and require strong MFA
Trend Micro says to remove direct RDP exposure to the internet and enforce multi-factor authentication on all administrative interfaces. Unit 42 asks for phishing-resistant MFA on all systems and regular credential rotation. Check Point says to assume credentials are already compromised and to watch for odd sign-in patterns across Microsoft 365 and VPN.
-
Protect EDR tools and block vulnerable drivers
Unit 42 recommends EDR tamper protection and monitoring for unsigned or known vulnerable drivers being loaded. Trend Micro adds password-protecting agent uninstallation and auto-isolating devices that show driver-based attacks.
-
Watch for Group Policy and scheduled task abuse
Unit 42 recommends high-severity SIEM alerts when a scheduled task matching the string gentlemen* is created, deleted or run. Trend Micro advises restricting domain controller share access and alerting on unauthorized changes to NETLOGON.
-
Limit lateral movement
Unit 42 recommends enforcing SMB signing, disabling SMBv1, restricting movement between network segments and watching for Advanced IP Scanner. Trend Micro adds segmentation between IT management tools and production systems, and monitoring for mass Active Directory queries and bulk group membership changes.
-
Harden ESXi hosts
Unit 42 says to keep SSH off on ESXi hosts by default and enable it only for planned maintenance. It also says to restrict ESXi management to a dedicated, isolated VLAN and to treat virtual infrastructure as tier-0.
-
Keep isolated backups and alert on recovery tampering
Check Point says backups must be offline, immutable and separated from the domain, because the group targets NAS devices and backup systems. Unit 42 recommends alerts when vssadmin or wmic delete Volume Shadow Copies and when wevtutil clears the Security or System logs.
-
Control remote access and file transfer tools
In the case Trend Micro investigated, the group used AnyDesk and WinSCP, and possibly PuTTY. Trend Micro recommends application control for remote access and file transfer tools, so unexpected use is blocked or alerted on.
Questions
What is The Gentlemen ransomware?
The Gentlemen is a ransomware-as-a-service program. Unit 42 says it has been active since at least July 2025, and Sophos says its first victims were posted to a leak site in September 2025. It steals data, encrypts files and threatens to publish the data.
How does The Gentlemen get into a network?
Check Point says entry is almost always through an unpatched internet-facing device such as a VPN or firewall. Unit 42 lists edge device vulnerabilities, brute force attacks, leaked or stolen credentials and initial access brokers. Sophos says affiliates kept lists of FortiGate devices vulnerable to CVE-2024-55591 and of brute-forced Fortinet VPN credentials.
How many victims has The Gentlemen claimed?
It depends on the source and the date. Check Point counted over 320 by 20 April 2026. Unit 42 cited an outside count of 580 across 77 countries through 7 July 2026. These are victims the group claimed on its leak site, not confirmed incidents.
Is The Gentlemen the same group as Qilin?
No. Sophos says the operator was earlier an affiliate of Qilin, which is a separate ransomware program. Unit 42, citing public reporting, says the operators were likely the Qilin affiliate known as ArmCorp.
Which systems does The Gentlemen encrypt?
Check Point says the group supports Windows, Linux and ESXi. Unit 42 says the encryptors are written in C and Go. The Windows locker turns off Microsoft Defender protection and tries to delete shadow copies before it encrypts.
In our research
Sources
- No Manners Here: The Ruthless Rise of The Gentlemen Ransomware Palo Alto Networks Unit 42
- Threat profile: GOLD SHERWOOD Sophos
- Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed Trend Micro
- The Gentlemen: A New Ransomware Threat Climbing the Charts, Fast Check Point Research
- DFIR Report: The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy Check Point Research
- When the Ransomware Gang Gets Hacked: What the Gentlemen Leak Reveals About Modern Ransomware Risk Check Point Research
- The State of Ransomware: Q1 2026 Check Point Research
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 27 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 79 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.