No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
Summary: The Gentlemen (aka Storm-2697) is a Ransomware-as-a-Service program active since at least July 2025, likely run by roughly 20 operators who moved from being a Qilin affiliate called ArmCorp to a RaaS model around September 2025. It offers affiliates a 90% cut of paid ransoms, uses encryptors written in C and Go, and has claimed 580 victims across 77 countries since inception, with 103 in manufacturing and 117 claimed in June 2026 alone.
Key Takeaway: A 90% affiliate payout undercuts the 70% to 80% norm and buys loyalty fast: The Gentlemen's victim count rose more than 6x between the last six months of 2025 and the first six months of 2026, making it the second most active RaaS program of 2026 despite operating for only four months of 2025.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026