Reported by 8 outlets
The Gentlemen Ransomware (Storm-2697) — Fastest-Growing RaaS of 2026 With 580 Victims Across 77 Countries
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.70 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Unit 42's July 10, 2026 report charts The Gentlemen, tracked by Microsoft as Storm-2697, as the second most active RaaS program of 2026 with 580 claimed victims across 77 countries through July 7, 103 of them in manufacturing. The program is the rebrand of ArmCorp, a Qilin affiliate that launched its own operation in September 2025 with a 90% affiliate payout, a core team of roughly 20 operators, and encryptors written in both C and Go, including a dedicated ESXi locker. Its signature is operator-supplied offense: the GentleKiller EDR-killer framework with at least eight driver-abusing variants, a custom Go backdoor, and a suspected zero-day exploit used to blind endpoint defenses.
The growth is a business-model result, not a technical breakthrough, and that is what makes this story rank above most of the rest of the day's queue. Halcyon's May 2026 assessment documents an inventory of roughly 14,700 already-compromised FortiGate devices plus nearly a thousand brute-forced FortiGate VPN credentials, built while the operators paid affiliates 90% where the market standard is 70 to 80%. That stockpile means an organization patching CVE-2024-55591 today can still be holding a pre-positioned access path, because the credentials and sessions were harvested before the fix; remediation without an exploitation audit leaves the door open. Exposure also does not follow the usual geography. Only 7% of claimed victims are US-based, Thailand leads with 27, and the group's leaked internal chats show affiliates sorting candidates by FortiGate misconfiguration rather than country, so edge-device hygiene, not location or company size, is the risk variable.
Scope and patch the five CVEs the events carry: CVE-2024-55591 on FortiOS and FortiProxy, CVE-2025-32433 on Erlang/OTP SSH, CVE-2025-33073 in the Windows SMB client, CVE-2025-55182 (React2Shell), and CVE-2025-7771 for the ThrottleStop.sys driver. For every FortiGate that was internet-facing during the CVE-2024-55591 window, audit for prior compromise rather than assuming the patch closed it. Hunt for scheduled tasks matching gentlemen*, directories named GentlemenCollection, and unsigned binaries whose version information impersonates security vendors, the naming scheme ESET documented across the killers. Alert on wevtutil clearing the Security or System logs, vssadmin or wmic shadow copy deletion, and AnyDesk, WinSCP, or Advanced IP Scanner appearing on servers. Enforce SMB signing, disable SMBv1, keep SSH off ESXi hosts outside maintenance windows, and move ESXi management interfaces to a dedicated VLAN. A README-GENTLEMEN.txt note or a .7mtzhh file extension, first documented by Trend Micro in September 2025, confirms impact.
Two developments would change this assessment. A CVE identifier and patch for the zero-day Expel analyzed on June 30 would convert the group's most disruptive defense-evasion tool into a routine patch cycle, so track Expel and ESET for that disclosure. And the May 2026 insider leak, which exposed nine internal accounts including zeta88, the handle tied to hastalamuerte, should have slowed the group; if claimed victims hold near June's 117 through July and the HasanBroker BreachForums recruiting partnership keeps supplying affiliates, the leak was a speed bump and the 90% model remains the story.
Timeline
-
original reporting
The Gentlemen Ransomware (Storm-2697) — Fastest-Growing RaaS of 2026 With 580 Victims Across 77 Countries
unit42.paloaltonetworks.com · 95d ago · July 11th, 2026
Unit 42 has published a comprehensive analysis of The Gentlemen (tracked as Storm-2697), a Ransomware-as-a-Service program that has rapidly become the second most active ransomware operation of 2026. Formerly operating as "ArmCorp" — an affiliate of Qilin RaaS (Spikey Scorpius) — the group transitioned to its own RaaS model in September 2025 and has since claimed 580 victims across 77 countries, with manufacturing as the most-targeted sector.
Key operational details:
-
Ransomware variants written in both C and Go, enabling cross-platform encryption across operating systems and virtual infrastructure (ESXi hypervisors)
-
90% affiliate payout — an unprecedented revenue share designed to aggressively recruit operators, compared to the standard 70-80%
-
Custom tooling: Go-based backdoor, "GentleKiller" EDR killer framework, and suspected zero-day exploit for defense evasion
-
Victim count trajectory: 117 claimed victims in June 2026 alone — nearly 4x January 2026; 6x growth comparing the last six months of 2025 to the first six months of 2026
-
BreachForums partnership with HasanBroker announced in May 2026 for affiliate recruitment
-
Internal database leak by an alleged insider in May 2026 revealed operational structure (~20 operators)
Known exploited CVEs for initial access include CVE-2024-55591 (FortiOS/FortiProxy), CVE-2025-32433 (Erlang/OTP SSH), CVE-2025-33073 (Windows SMB Client), CVE-2025-55182 (React2Shell), and CVE-2025-7771 (ThrottleStop.sys driver for privilege escalation). Unit 42 recommends SIEM alerts for scheduled tasks matching
gentlemen*, enforcement of SMB signing, disabling SMBv1, and restricting ESXi management interfaces to dedicated VLANs. -
-
update from trendmicro.com
Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed
trendmicro.com · 400d ago · September 9th, 2025
Trend Micro documented an August 2025 intrusion by The Gentlemen, then an undocumented group, that began with the compromise of an internet-exposed FortiGate appliance and its administrative account. The attackers killed security tooling with All.exe and ThrottleBlood.sys abusing the signed ThrottleStop.sys driver, then deployed password-protected ransomware domain-wide through the NETLOGON share. Victims spanned 17 countries, with manufacturing, construction, healthcare, and insurance most targeted; encrypted files received .7mtzhh extensions and README-GENTLEMEN.txt ransom notes.
-
update from halcyon.ai
Threat Assessment: The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record
halcyon.ai · 144d ago · May 22nd, 2026
Halcyon assesses The Gentlemen split from Qilin after the ArmCorp affiliate's operator hastalamuerte complained on the RAMP forum on 22 July 2025 about roughly $48,000 in unpaid commission, with the first Gentlemen sample appearing on VirusTotal on 17 July 2025. The core team is roughly 20 members, pays affiliates 90% of ransoms, and researchers revealed an inventory of approximately 14,700 already-compromised FortiGate devices plus nearly a thousand brute-forced FortiGate VPN credentials. The report also recounts the 4 May 2026 internal database leak that exposed nine internal accounts, including zeta88.
-
update from microsoft.com
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
microsoft.com · 138d ago · May 28th, 2026
Microsoft tracks The Gentlemen as Storm-2697 and dissects the group's self-propagating Go encryptor. This analysis is the source of the Storm-2697 identifier used in later vendor reporting on the group.
-
update from krebsonsecurity.com
Who Runs the Ransomware Group The Gentlemen?
krebsonsecurity.com · 125d ago · June 10th, 2026
Brian Krebs published evidence on the identity of hastalamuerte, founder and administrator of The Gentlemen, whom Group-IB describes as a disgruntled former Qilin affiliate.
-
update from welivesecurity.com
Killing me gently: Inside Gentlemen's EDR killer framework
welivesecurity.com · 118d ago · June 18th, 2026
ESET details GentleKiller, The Gentlemen's operator-maintained EDR-killer framework with at least eight variants abusing vulnerable or malicious drivers, staged from a GentlemenCollection directory alongside the third-party killers HexKiller, ThrottleBlood, and HavocKiller. GentleKiller targets more than 400 processes across 48 security products, and ESET observes the gang's victimology is globally distributed with no strong US focus.
-
mentioned by securelist.com
The Gentlemen RaaS
securelist.com · 106d ago · June 29th, 2026
-
mentioned by expel.com
Not Very Gentlemanly: Analyzing a Zero-Day Exploit Used by The Gentlemen Ransomware to Disable Targets' EDRs
expel.com · 105d ago · June 30th, 2026