The Gentlemen Ransomware Notes

by duckie · 15 aug 2026

• SHA256: 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67
• MD5: 7a262d4cbbc4808932b6af42c4041f06
• SHA1: 9e951cf2f868b71aaaa05966d8eb96d333b80106
• CRC32: a287bcbe
• Entropy: 6.58

64-bit Go PE, heavily obfuscated with Garble. About 2647 functions. Ransom note name, wallpaper, and file extension are not present as plain text in this build.

Arguments

Needs --password or it exits (anti-sandbox gate).

Known flags:

• --password : required to run
• --spread : self-propagation
• --wipe : free space overwrite after encryption
• --fast : ~9% partial encryption
• --superfast : ~3%
• --ultrafast : ~0.9%

Default encrypts roughly 27% of each file. Partial encryption is still enough to break the file.

What it does

Hybrid encryption: per-file Curve25519 key, ECDH with operator public key, XChaCha20 for content. Ephemeral public key stored in file footer for later decrypt.

Walks local and network drives, skips some system paths, encrypts files, drops README-GENTLEMEN.txt, can set wallpaper to gentlemen.bmp.

With --spread it copies itself to other hosts (SMB, PsExec-style, WMI, tasks, etc.).

After encryption: deletes shadow copies, clears event logs, optional free-space wipe. Some builds self-delete.

File extension

Per-build extension. In THIS sample it is not recoverable as plaintext (Garble).

Earlier LEAs in mal_encrypt_or_main looked like extension candidates but resolve to DLL names:

• 0x14014f9e2 advapi32.dll
• 0x14014f41d crypt32.dll
• 0x14014eef2 dnsapi.dll
• 0x14014f9ee iphlpapi.dll

Do not treat those as the ransomware extension.

Evasion

• Password gate
• Garble obfuscation
• Defender disable / exclusions (family behavior)
• Log and forensic cleanup
• BYOVD via GentleKiller in many campaigns
• Living-off-the-land tools

Important functions

High confidence:

• 0x140078b20 mal_entry : PE entry / Go bootstrap
• 0x14001a520 mal_core_logic : early setup / likely arg handling
• 0x140085020 mal_encrypt_or_main : main encrypt control (starts with API DLL string setup)
• 0x1400fd260 mal_largest_func : largest routine, bulk work
• 0x1400922a0 mal_encryption_support : supporting encrypt logic
• 0x1400c7280 mal_complex_helper : complex helper

Best-effort labels (not fully proven from clean decompile):

• 0x140045aa0 mal_control_dispatcher
• 0x14001e2e0 mal_crypto_helper
• 0x140029680 mal_state_manager
• 0x140007f60 mal_data_handler
• 0x140009020 mal_memory_compare
• 0x14000ff80 mal_startup_init
• 0x140012320 mal_update_state
• 0x140071600 mal_option_parser
• 0x1400d58c0 mal_finalizer
• 0x14007da80 mal_sync_lock
• 0x140066d60 mal_path_helper
• 0x140042260 mal_setup_config

Start order: mal_entry -> mal_core_logic -> mal_encrypt_or_main -> mal_largest_func

Visible strings

• 0x1401af341 main.main
• 0x140113d63 Encrypt
• 0x14036e6e2 / 0x14039ae30 CryptEncrypt

IOCs (this sample)

Hashes above. PE64 Go Garble. Entropy 6.58. Family artifacts on disk (other builds): README-GENTLEMEN.txt, gentlemen.bmp, gentlemen_system task, per-build short extension.

Victimology

Active since mid-2025. By mid-2026 among top claim-volume groups.

Sectors: manufacturing, professional services, technology, healthcare, transport, finance. Regions: 60+ countries. US often highest volume, also Thailand, Brazil, France, Germany, India, Colombia. Opportunistic, access-driven, double extortion. Hits SMBs and mid-market a lot.

Timeline:

• Mid 2025: first activity
• Sep 2025: RaaS more visible
• Early 2026: sharp rise in claims
• May 2026: internal leak
• Mid/late 2026: still highly active

YARA

rule TheGentlemen_Ransomware_Storm2697
{
    meta:
        description = "Detects The Gentlemen ransomware (Storm-2697) Go/Garble builds"
        author = "threat-intel"
        reference = "The Gentlemen / Storm-2697"
        date = "2026-08-15"

    strings:
        $s_main = "main.main" ascii
        $s_encrypt = "Encrypt" ascii
        $s_crypt = "CryptEncrypt" ascii

        $f_note = "README-GENTLEMEN.txt" ascii
        $f_bmp = "gentlemen.bmp" ascii
        $f_task = "gentlemen_system" ascii
        $f_marker = "--marker--GENTLEMEN" ascii
        $f_eph = "--eph--" ascii
        $f_pass = "--password" ascii
        $f_spread = "--spread" ascii
        $f_wipe = "--wipe" ascii
        $f_superfast = "--superfast" ascii
        $f_banner = "[+] Encryption started" ascii

        $go1 = "runtime.main" ascii
        $go2 = "Go buildinf:" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 15MB and
        (
            (3 of ($s_*) and 1 of ($go*))
            or
            (2 of ($f_*) and 1 of ($go*))
        )
}