The Gentlemen ransomware pairs encryption with multiple routes across a network

Microsoft analysed The Gentlemen ransomware on 28 May, describing a Go-based encryptor with several methods for moving through an environment. The company tracks the financially motivated operators as Storm-2697 and says affiliates conduct attacks through its ransomware-as-a-service platform.

The report places the operation’s emergence in 2025 and describes its later recruitment of affiliates. That operating model means the encryptor and the person gaining initial access are not necessarily the same actor. Microsoft’s analysis focuses on the combination of encryption and self-propagation. Defenders investigating an affected endpoint therefore need to examine access elsewhere in the environment, rather than treating the visible encrypted files as the complete extent of the intrusion.