Assessment at a glance

Identity: The Gentlemen, also reported as Storm-2697 (Unit 42). Model: ransomware-as-a-service with a reported 90% affiliate payout. APT number: none established here. CrowdStrike alias: not established by the retained sources. Evidence supports an operator-maintained service and affiliate activity. It does not attribute every intrusion to the same hands-on team.

The central operational feature is a maintained capability for disabling endpoint security, combining an in-house framework (GentleKiller) with externally sourced tools. Defenders therefore need to monitor security-control health independently of the endpoint agent an attacker is trying to stop.

Figures for victims and growth below are leak-site claims relayed by the cited vendors, not verified incident counts.

Timeline and relationships

Unit 42 dates the programme to at least July 2025. The sources are not fully consistent on start dates, so treat that date as a lower bound and not a firm launch date. Unit 42 also says the actors were only active for the last four months of 2025, its monthly victim chart begins in August 2025, and it places the move to a RaaS model around September 2025. ESET says the gang emerged in late 2025. Unit 42 further reports, citing public reporting, that the operators were likely active months earlier as a Qilin affiliate known as ArmCorp (Qilin is tracked by Unit 42 as Spikey Scorpius), and that roughly 20 operators likely moved from a private entity to a RaaS model. Unit 42 hedges both points. The relationship does not make The Gentlemen and the wider Qilin ecosystem interchangeable. Unit 42 investigation

ESET reports that Group-IB disclosed the founder as a former Qilin affiliate using the alias hastalamuerte, and that the gang's leader uses another alias, zeta88, in leaked internal data. ESET also cites PRODAFT, on 17 October 2025, saying the operators had previously been affiliates of Qilin, Embargo, LockBit, Medusa and BlackLock. ESET notes that Brian Krebs published evidence about the founder's identity on 10 June 2026. This profile does not repeat identity claims and treats the prior-affiliation reports as third-party assessments that were not independently verified here. ESET research

Unit 42 reports that an alleged insider leaked an internal database in May 2026, and that in May 2026 the group announced a partnership with HasanBroker's BreachForums to recruit affiliates, penetration testers and initial access brokers. ESET used the same leak to corroborate its earlier hypothesis that the operators maintain and supply EDR-killer packages. Unit 42 investigation

Operating model and tooling

Unit 42 reports ransomware variants written in C and Go, which lets the encryptors run across operating systems and virtual infrastructure. ESET describes a Go variant targeting Windows, Linux and other platforms and a C variant for ESXi. ESET states that the group uses double extortion: encrypting data and threatening to publish it if payment is not made. Unit 42 does not describe the extortion model but reports leak-site victim claims, which are consistent with it. Unit 42 also reports a custom Go-based backdoor. It reports the suspected use of an unspecified zero-day exploit to strengthen defence evasion. That claim is insufficient to assign a vulnerability identifier or claim a confirmed exploit chain, and this profile leaves it unresolved. Unit 42 investigation ESET research

According to ESET, the operators are responsible for the ransomware payload, and affiliates deploy it and handle exfiltration. ESET also describes a credential stealer it names OxideHarvest, written in Rust. ESET does not attribute the tool to the group itself, but a sample named buildx641.exe matches a tool maintained by a Gentlemen affiliate called quant, as noted by Check Point. ESET concludes the two are the same tool. This is an affiliate-linked tool, not evidence of operator development. ESET research

Initial access and exploited vulnerabilities

Unit 42 reports a range of initial access techniques similar to other RaaS operators: exploitation of edge-device vulnerabilities (firewalls, VPNs), brute force, leaked or stolen credentials, and collaboration with initial access brokers. ESET adds that leaked data indicates a centralised process in which candidate victims are sorted and distributed to affiliates, chosen primarily on FortiGate (mis)configuration rather than geography. Unit 42 investigation ESET research

Unit 42's recommendations list vulnerabilities it describes as known to be exploited. The source gives no per-incident attribution, so treat these as patching priorities and not as a confirmed attack chain for any one intrusion:

  • CVE-2024-55591 (Fortinet FortiOS and FortiProxy)
  • CVE-2025-32433 (Erlang/OTP SSH server)
  • CVE-2025-33073 (Windows SMB client)
  • CVE-2025-55182 (React2Shell)
  • CVE-2025-7771 (ThrottleStop.sys driver), listed for privilege escalation

Unit 42's recommendations also reference a self-propagation mechanism and advise SMB hardening and keeping SSH off on ESXi hosts. It does not describe how the propagation works or document SSH-based lateral movement to ESXi, so this profile does not either. Unit 42 investigation

Defence impairment as a maintained service

ESET analysed a suite supplied to affiliates, centred on GentleKiller. It identified at least eight variants, each impersonating a different product and abusing a different vulnerable or malicious driver, built on a shared template. GentleKiller loops to terminate processes and targets more than 400 process names that ESET mapped, using AI assistance and with acknowledged possible inconsistencies, to 48 security products. ESET says the template lets the operators adopt newly disclosed BYOVD proofs-of-concept quickly: UnknownKiller and PoisonKiller were adopted within days. ESET research

The suite also includes tools ESET assesses with high confidence were not developed in-house but obtained externally and adapted:

  • HexKiller (abuses a Baidu Antivirus driver) was previously assessed by ESET as exclusive to the Warlock gang. ESET stresses that its presence does not by itself imply collaboration with Warlock, and that it may have been obtained through private exchange or leaks.
  • ThrottleBlood (abuses ThrottleStop.sys) has been seen in MedusaLocker and, less often, DragonForce intrusions. Trend Micro linked it to Gentlemen in September 2025. ESET cannot establish its origin and states only that Gentlemen did not develop it.
  • HavocKiller (abuses a Huawei audio driver) was publicly disclosed by Huntress on 19 March 2026. ESET telemetry shows ransomware-related use from at least 23 January 2026.

ESET also saw DemoKiller in several intrusions but excluded it from the suite because it showed no tie to Gentlemen. ESET research

ESET describes a standardised evasion layer applied to compiled samples, which lets the group protect tools whose source it does not hold. It consists of Enigma or Themida packing, vendor-resembling filenames (especially security vendors), fabricated version information, invalid signatures copied from legitimate executables and matching icons. Filename suffixes indicate the method: 1 (Enigma), 2 (Themida), Light (no packer, fake signature and version information) and clear (none). ESET observed these tools staged in a directory named GentlemenCollection across unrelated intrusions involving Gentlemen affiliates. It concludes the operators maintain the suite, which the leak confirmed. TIR assessment: individual intrusions likely remain dependent on the affiliate who carries them out. ESET research

Victimology and scale (leak-site claims)

ESET notes that Gentlemen does not show the strong US focus of most large ransomware groups. Its affiliates target victims across Southeast Asia, South America and Western Europe, including Thailand, Brazil and France. ESET research

Unit 42 cites one source counting 580 claimed victims across 77 countries from inception through 7 July 2026, 103 of them in manufacturing. It reports that claimed victims rose by slightly more than six times between the last six months of 2025 and the first six months of 2026, and that June 2026 was the highest month to date at 117 claimed victims. Unit 42 describes the group as the second most active RaaS programme of 2026 by claimed victims. These are leak-site postings, which can include unverified or duplicated claims. They show activity levels but cannot confirm successful compromise. Unit 42 investigation

Operational implications

TIR assessment: concentrating only on the encryptor misses an earlier intervention point. A newly introduced driver, security-policy change or unexpected loss of telemetry can precede visible damage. Correlate those events with the identity and remote-access session that introduced them.

Driver installation as a service is a persistence-related technique in ESET's ATT&CK mapping (T1543.003), but kernel driver abuse is not automatically firmware persistence, a UEFI rootkit or a measured long-term foothold. These sources establish defence-impairment capabilities. They do not establish universal dwell time, and possession of several tools does not prove every affiliate used them all.

TIR assessment: a maintained toolkit may lower the effort required for an affiliate to attempt a technique, but possession does not demonstrate successful deployment against a particular organisation. The operator and affiliate distinction matters both to incident attribution and to forecasts about future activity.

Detection and recovery

The following pivots come from the cited sources. Treat each as a hunting lead to validate in your own environment, not as proof of Gentlemen involvement.

  • Staging and naming: search for a directory named GentlemenCollection and for executables using the suffixes above, with vendor-style filenames and icons that do not match signatures or approved installation paths. ESET publishes SHA-1 indicators for GentleKiller variants, HexKiller, ThrottleBlood, HavocKiller and OxideHarvest in its report.
  • Execution: Unit 42 recommends high-severity alerts on the creation, deletion or execution of scheduled tasks matching the string gentlemen*.
  • Defence impairment: enable EDR tamper protection, monitor for unsigned or known vulnerable driver loads, and alert on wevtutil clearing Security or System logs. Monitor GentleKiller's console-style execution and driver service installation.
  • Discovery and command and control: watch for internal use of Advanced IP Scanner and for outbound traffic over non-standard ports or matching SystemBC signatures.
  • Lateral movement and ESXi: enforce SMB signing and disable SMBv1. Keep SSH off on ESXi hosts except during maintenance, and isolate ESXi management interfaces on a dedicated management VLAN.
  • Impact: alert on vssadmin and wmic deleting Volume Shadow Copies, and maintain validated offline backups.

Retain driver-load, service-change and privileged execution telemetry outside the endpoint. Investigate loss of EDR visibility alongside identity, remote-administration and backup-access events, and test whether alerts reach responders when the endpoint security service stops. Where supported, validate vulnerable-driver blocking against business dependencies and monitor enforcement rather than assuming configured policy is effective. Audit edge devices and internet-facing RDP for prior exploitation, and prioritise patching of the vulnerabilities listed above.

Preserve evidence of the security-control failure during recovery. Rebuild trust in administrative identities and verify protective services are running and reporting. Restoring files without addressing the route used to disable protection leaves the operational weakness available.

Related coverage and update record

Read TIR's analysis of remote access, defence impairment and recovery. This profile supplies naming and capability context without attributing incidents from a shared driver alone.

Version 1 (30 October 2026): initial profile. It qualifies the Qilin relationship, prior-affiliation reports and conflicting start dates, adds initial access, victimology, operating-model, tooling and detection detail, labels leak-site figures as claims, attributes the double-extortion description to ESET, limits Unit 42's lateral-movement material to its recommendations, and separates demonstrated security impairment from speculative persistence and dwell-time claims.