- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1058 · 17 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0354 · the-gentlemen
What it is
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Storm-2697
- Secureworks
- GOLD SHERWOOD
Tools
The tools and malware families the sources tie to it.
- CrossRat
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
- PsExec
- The Gentlemen Ransomware
- Wevtutil
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de