The Gentlemen

Introduction

The Gentlemen is a ransomware group that employs a dual-extortion strategy, encrypting sensitive files while exfiltrating critical business data to pressure victims into paying ransoms. Their operations leverage advanced techniques such as abusing legitimate utilities like PowerRun.exe for privilege escalation, using custom-built tools for defense evasion, and employing flexible encryption methods based on file size. The group targets medium to large organizations across various sectors, particularly in the Asia-Pacific region, and has demonstrated a high level of technical maturity and operational discipline. Their activities include systematic compromise of enterprise environments, mass account enumeration, and the use of encrypted channels for data exfiltration.

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1027.002 Software Packing
• T1068 Exploitation for Privilege Escalation
• T1583.001 Domains
• T1486 Data Encrypted for Impact
• T1585.001 Social Media Accounts
• T1683.001 Written Content
• T1036 Masquerading
• T1036.005 Match Legitimate Resource Name or Location
• T1036.001 Invalid Code Signature
• T1190 Exploit Public-Facing Application
• T1657 Financial Theft
• T1683.002 Audio-Visual Content
• T1219.002 Remote Desktop Software
• T1585 Establish Accounts
• T1588.002 Tool
• T1018 Remote System Discovery
• T1078 Valid Accounts

Ransomware Vulnerability Matrix observations

ATT&CK technique IDs (denormalized)

• T1018
• T1027.002
• T1036
• T1036.001
• T1036.005
• T1068
• T1078
• T1190
• T1219.002
• T1486
• T1583.001
• T1585
• T1585.001
• T1588.002
• T1657
• T1683.001
• T1683.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• PowerDuke
• POWERSTATS
• Power Loader
• POWERSOURCE
• PowerRAT
• CrossRat

MITRE ATT&CK Software

• Wevtutil (S0645) — tool
• The Gentlemen Ransomware (S9051) — malware
• PsExec (S0029) — tool

Ransomware Tool Matrix observations

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [4] BradyUnit42_TheGentlemen_July2026 Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026. [5] CarveyODonnellWelchHuntress_TheGentlemen_May2026 Carvey, H., O’Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026. [6] CheckPointResearch_TheGentlemen_April2026 Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026. [7] Intel471_TheGentlemen_Aug2026 Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026. [8] MSTI_GentelmenRansomware_May2026 Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026. [9] TrendAI_TheGentlemen_Sept2025 Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026. [10] Sophos_TheGentlemen_Sept2026 Sophos Counter Threat Unit Research Team. (2026, September 1). Ungentlemanly behavior: Insights into a ransomware operation. Retrieved September 18, 2026. [11] SoučekESET_Gentlemen_Jun2026 Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.