The Gentlemen (Storm-2697) is a fast-scaling Ransomware-as-a-Service (RaaS) group offering a 90% revenue share to affiliates.
Analyst brief
The Gentlemen (Storm-2697) is a Ransomware-as-a-Service (RaaS) group that emerged in mid-2025, rapidly scaling by offering affiliates a 90% revenue share. The group targets multiple sectors—including Manufacturing, Technology, Healthcare, and Government & Defense—across 17+ countries such as the United States, Germany, India, Japan, and Brazil. Their key TTP involves deploying a Go-based locker capable of encrypting Windows, Linux, NAS, and BSD systems. Defenders should prioritize securing NAS and multi-OS environments, and focus detection efforts on cross-platform Go-based encryption activity and anomalous file modifications.
thegentlemen
Storm-2697
activecrime
The Gentlemen is a RaaS group that emerged in July–August 2025, rapidly claiming over 320 victims across 17+ countries by offering affiliates a 90% revenue share, deploying a Go-based locker against Windows, Linux, NAS, and BSD systems; a compromised C2 server in 2026 revealed more than 1,570 linked victims.