# The Gentlemen Ransomware

Human-operated ransomware (RaaS) · Tracked as Storm-2697 · First seen mid-2025 · Windows · Last updated July 20, 2026

## Overview

The Gentlemen is a human-operated ransomware-as-a-service operation that emerged in mid-2025 and moved to an affiliate model in September 2025. Microsoft Threat Intelligence tracks the operators as Storm-2697 and describes the encryptor as a Go binary obfuscated with Garble that targets Windows. The operation uses double extortion: data is stolen before encryption, then victims are pressured with the threat of public release on a leak site if they do not pay.

Two properties make this a network-wide problem rather than a single-host one. First, the encryptor pairs strong per-file encryption with an aggressive self-propagation module. Microsoft documents that a single infected host attempts 21 distinct remote execution operations against every reachable system it discovers, so one successful path keeps the spread going. Second, before it encrypts, it methodically disables defenses, terminates backup and security services, and destroys local recovery options.

Initial access is not driven by novel exploits. Reporting attributes entry to internet-facing edge devices, SSL-VPNs, and remote management interfaces, together with valid accounts and credentials bought from initial-access brokers. KrebsOnSecurity reports the operator supplies affiliates with SSL-VPN credentials obtained through brute force or from the group's own data. One documented edge-device vector is the FortiOS and FortiProxy authentication bypass [CVE-2024-55591, which CISA added to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) in January 2025.

The Gentlemen is not a stealer or a loader. Its objective is impact: mass file encryption and extortion. For defenders, the useful signal is the pre-encryption sequence, which is loud in endpoint telemetry: Defender tampering, backup service termination, Volume Shadow Copy deletion, event-log clearing, and a burst of remote-execution attempts across the network.

### Threat profile

**Updated July 20, 2026**

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Mid 2025 |
| Tracked as | Storm-2697 |
| Impact | Encryption + leak |
| Aliases | Storm-2697, LARVA-368, ArmCorp lineage |
| Language | Go, obfuscated with Garble |
| Encryption | Curve25519 + XChaCha20, per-file keys |
| File marker | .umc16h · README-GENTLEMEN.txt |
| Initial access | Edge devices, SSL-VPN, valid accounts, IABs |
| Targets | Windows endpoints and servers, global |
| Model | Double extortion, affiliate RaaS |

## Operational attack chain · edge access to domain-wide encryption

1. **Start — Edge device / VPN**  
   CVE-2024-55591 · valid accounts · IAB credentials

2. **Stage 1 — Recon and privilege escalation**  
   Domain admin access · GPO abuse

3. **Stage 2 — SYSTEM execution**  
   Scheduled task `gentlemen_system` relaunches payload as SYSTEM

4. **Stage 3 — Defense evasion**  
   Defender disabled · backups and logs terminated · VSS deleted · event logs cleared  
   `Set-MpPreference` · `vssadmin` · `wevtutil`

5. **Stage 4 — Encryption**  
   Curve25519 / XChaCha20 per-file keys · `.umc16h` extension appended

6. **Stage 5 — Self-propagation**  
   21 techniques per target · PsExec / WMI / WinRM / scheduled tasks / services

7. **Impact — Double extortion**  
   Leak-site threat · recovery destroyed on-host · ransom demand

The intrusion is human-operated and can span hours to days between initial access and encryption. Because the RaaS model puts the encryptor in many affiliate hands, the hands-on-keyboard phase varies, but the encryptor's own pre-encryption and propagation behavior is consistent across deployments. The pre-encryption sequence is where [detection](https://www.manageengine.com/malware-protection/malware-detection.html) windows open.

## Tactics, techniques, and procedures

The Gentlemen maps to a broad set of MITRE ATT&CK Enterprise tactics, with the heaviest density in Execution, Defense Evasion, Discovery, Lateral Movement, and Impact. The coverage below reflects behavior documented in the Microsoft Threat Intelligence encryptor analysis, plus initial-access reporting from CISA and independent journalism.

### MITRE ATT&CK coverage

| Tactic | Count |
|---|---|
| Recon | 0 |
| Resource Development | 0 |
| Initial Access | 3 |
| Execution | 4 |
| Persistence | 2 |
| Privilege Escalation | 2 |
| Defense Evasion | 4 |
| Credential Access | 2 |
| Discovery | 4 |
| Lateral Movement | 4 |
| Collection | 1 |
| Command and Control | 1 |
| Exfiltration | 1 |
| Impact | 5 |

### Technique detail

| Tactic | Techniques | What The Gentlemen does | Defender telemetry |
|---|---|---|---|
| Initial Access | [T1190](https://attack.mitre.org/techniques/T1190/) · [T1133](https://attack.mitre.org/techniques/T1133/) · [T1078](https://attack.mitre.org/techniques/T1078/) | Entry through internet-facing edge devices and SSL-VPNs, including CVE-2024-55591, plus valid accounts and broker-supplied credentials. | VPN and firewall authentication logs, new super-admin or local account creation on edge devices, edge configuration changes, sign-ins from new geographies. |
| Execution | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) · [T1047](https://attack.mitre.org/techniques/T1047/) · [T1569.002](https://attack.mitre.org/techniques/T1569/002/) · [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Uses PowerShell, wmic, schtasks, sc, and embedded PsExec locally and remotely. | Process creation logs, PowerShell script-block logs, service and scheduled-task creation events. |
| Persistence | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) · [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled tasks `UpdateSystem` and `UpdateUser`, plus Run-key values `GupdateS` (HKLM) and `GupdateU` (HKCU). | Scheduled-task creation (event 4698), registry Run-key writes. |
| Privilege Escalation | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) · [T1078](https://attack.mitre.org/techniques/T1078/) | Creates `gentlemen_system` task to relaunch as SYSTEM and sets `LOCKER_BACKGROUND=1`. | SYSTEM task creation, unusual SYSTEM child processes from user-writable paths. |
| Defense Evasion | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) · [T1070.001](https://attack.mitre.org/techniques/T1070/001/) · [T1070.004](https://attack.mitre.org/techniques/T1070/004/) · [T1027](https://attack.mitre.org/techniques/T1027/) | Disables Defender, adds exclusions, terminates services, clears logs with `wevtutil`, deletes artifacts, obfuscated with Garble. | Defender configuration changes, `Set-MpPreference`, `wevtutil cl`, `taskkill`, `sc stop`. |
| Credential Access | [T1110](https://attack.mitre.org/techniques/T1110/) · [T1003](https://attack.mitre.org/techniques/T1003/) | VPN brute force or purchased credentials; harvesting domain credentials during intrusion. | Repeated VPN failures, LSASS access, anomalous Kerberos/NTLM activity. |
| Discovery | [T1082](https://attack.mitre.org/techniques/T1082/) · [T1135](https://attack.mitre.org/techniques/T1135/) · [T1018](https://attack.mitre.org/techniques/T1018/) · [T1083](https://attack.mitre.org/techniques/T1083/) | Enumerates volumes, drives A–Z, mapped drives, UNC shares, and reachable systems; enables network discovery services. | WMI queries, service enablement (fdrespub, fdPHost, SSDPSRV, upnphost), host enumeration bursts. |
| Lateral Movement | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) · [T1021.006](https://attack.mitre.org/techniques/T1021/006/) · [T1570](https://attack.mitre.org/techniques/T1570/) · [T1047](https://attack.mitre.org/techniques/T1047/) | Publishes hidden `share$`, stages PsExec, copies via C$, attempts 21 remote executions per host. | Remote task/service creation, PsExec artifacts, SMB writes, WinRM logs, fan-out from single host. |
| Collection | [T1560](https://attack.mitre.org/techniques/T1560/) | Archives sensitive data for exfiltration before encryption. | Large archive creation, rapid share reads, staging directories filling. |
| Command and Control | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Operators use commodity C2; encryptor largely self-contained. | Beacon-like outbound sessions, proxy traffic from servers. |
| Exfiltration | [T1567](https://attack.mitre.org/techniques/T1567/) | Large-scale data exfiltration to enable leak-site pressure. | Sustained large outbound transfers to cloud/web endpoints. |
| Impact | [T1486](https://attack.mitre.org/techniques/T1486/) · [T1490](https://attack.mitre.org/techniques/T1490/) · [T1489](https://attack.mitre.org/techniques/T1489/) · [T1491.001](https://attack.mitre.org/techniques/T1491/001/) · [T1657](https://attack.mitre.org/techniques/T1657/) | Encrypts files with `.umc16h`, deletes shadow copies, stops services, sets ransom wallpaper, drops `README-GENTLEMEN.txt`. | Mass rename to `.umc16h`, high-rate file modification, shadow-copy deletion, ransom-note creation. |

## Indicators of compromise

Durable indicators come first. Prefer behavioral indicators for evergreen detection.

### File and encryption artifacts (Durable)

- `*.umc16h` — appended extension on encrypted files  
- `README-GENTLEMEN.txt` — ransom note dropped in each directory  
- `%TEMP%\gentlemen.bmp` — ransom wallpaper bitmap  
- `C:\Temp\<payload>` · `C:\Temp\psexec.exe` · `wipefile.tmp` — staging and wipe artifacts  

### Persistence, task, and service names (Durable)

- `gentlemen_system` · `UpdateSystem` · `UpdateUser` — scheduled tasks  
- `DefU` · `UpdateGU` · `UpdateGU2` — remote tasks  
- `DefSvc` · `UpdateSvc` · `UpdateSvc2` — remote services  
- `HKLM\...\Run\GupdateS` · `HKCU\...\Run\GupdateU` — registry Run keys  

### Behavioral and command patterns (Durable)

- `vssadmin delete shadows` / `wmic shadowcopy delete` + `sc stop` backup/EDR  
- `wevtutil cl System / Application / Security`  
- Hidden `share$` SMB share with anonymous access  
- `LOCKER_BACKGROUND=1` · PsExec from Sysinternals Live  

### Volatile indicators (hashes)

Use for retrospective hunting only.

- `22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67` — encryptor (SHA-256)  
- `078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b` — bundled PsExec (SHA-256)  
- `fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68` — wallpaper bitmap (SHA-256)  

## What defenders can detect

[Signature scanning](https://www.manageengine.com/malware-protection/articles/signature-based-detection.html) misses the encryptor because each build mutates and the password gate blocks naive detonation. Behavioral detection works because the pre-encryption and propagation phases combine trusted-binary abuse, recovery destruction, and remote-execution fan-out in a sequence that normal administration does not produce.

1. **Shadow-copy deletion with backup service termination**  
   Alert on `vssadmin delete shadows` or `wmic shadowcopy delete` near `sc stop` or `taskkill` against backup/security services.

2. **Microsoft Defender tampering**  
   Detect `Set-MpPreference -DisableRealtimeMonitoring` and whole-volume exclusions.

3. **Event-log clearing and history wiping**  
   Alert on `wevtutil cl` against System, Application, and Security in quick succession.

4. **Remote-execution fan-out from a single host**  
   Correlate hidden `share$`, C$ writes, and remote task/service creation across many peers.

5. **SYSTEM relaunch from user-writable paths**  
   Detect SYSTEM tasks launching binaries from `C:\Temp` and names like `gentlemen_system`.

6. **Encryption in progress**  
   High-rate rename to `.umc16h`, mass `README-GENTLEMEN.txt` creation, wallpaper change to `%TEMP%\gentlemen.bmp`.

7. **Edge-device and VPN anomalies**  
   Monitor for rogue admin accounts, VPN anomalies, and exposure to CVE-2024-55591.

## Hardening recommendations

**Quick win** = deployable in days.  
**Standard** = requires phased rollout.

1. **Patch and lock down internet-facing edge devices** (Quick win)  
   Remediate CVE-2024-55591, restrict management interfaces, enforce phishing-resistant MFA.

2. **Enable tamper protection and prevent Defender disablement** (Quick win)  
   Enforce tamper protection and alert on real-time monitoring disablement or C:\ exclusions.

3. **Constrain lateral movement** (Standard)  
   Restrict PsExec, WMI, SMB1, admin shares, and WinRM. Segment networks.

4. **Protect backups and recovery** (Standard)  
   Maintain offline or immutable backups. Monitor for shadow-copy deletion.

5. **Enforce least privilege and protect domain admin** (Standard)  
   Tiered administration, monitor GPO and privileged group changes, require MFA.

6. **Harden PowerShell and built-in tooling** (Quick win)  
   Enable script-block logging and restrict interpreters where unnecessary.

If infection is confirmed: isolate affected hosts, preserve forensic artifacts, identify initial access, rotate credentials, hunt for propagation patterns, and restore from protected backups rather than paying.

## Primary references

- [Microsoft Threat Intelligence — The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://www.microsoft.com/en-us/security/blog/) — May 2026  
- [CISA — Known Exploited Vulnerabilities Catalog (CVE-2024-55591)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — 2025  
- [NVD — CVE-2024-55591 (FortiOS / FortiProxy authentication bypass)](https://nvd.nist.gov/vuln/detail/CVE-2024-55591) — 2025  
- [KrebsOnSecurity — Who Runs the Ransomware Group The Gentlemen?](https://krebsonsecurity.com/) — Jun 2026  
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current