The Gentlemen
IntrusionSet · ATTACK:enterprise:G1058
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1058",
"title": "The Gentlemen",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1058",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--973abd91-322f-4756-94b6-67381c4089b3",
"external_id": "G1058",
"domain": "enterprise",
"created": "2026-09-18T19:02:39.017Z",
"modified": "2026-09-30T17:41:50.958Z",
"version": "1.0",
"aliases": [
"The Gentlemen",
"Storm-2697",
"GOLD SHERWOOD"
],
"tactics": [
],
"source_references": [
{
"source_name": "Storm-2697"
},
{
"source_name": "GOLD SHERWOOD"
},
{
"source_name": "BradyUnit42_TheGentlemen_July2026",
"url": "https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"
},
{
"source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
"url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
},
{
"source_name": "CheckPointResearch_TheGentlemen_April2026",
"url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
},
{
"source_name": "Intel471_TheGentlemen_Aug2026",
"url": "https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"
},
{
"source_name": "MSTI_GentelmenRansomware_May2026",
"url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
},
{
"source_name": "TrendAI_TheGentlemen_Sept2025",
"url": "https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"
},
{
"source_name": "Sophos_TheGentlemen_Sept2026",
"url": "https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation"
},
{
"source_name": "SoučekESET_Gentlemen_Jun2026",
"url": "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03913b3d-2078-4ef1-b155-918cc9baf49c
SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d6a8206-686c-4c52-b282-8580b3afacd5
BradyUnit42_TheGentlemen_July2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--216bc52c-8353-4943-8a05-631abd091fe5
CheckPointResearch_TheGentlemen_April2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--277e1ee7-74d2-4024-8975-4611d2e87430
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4926189d-559f-488c-a465-25a23ce71880
CheckPointResearch_TheGentlemen_April2026 · Sophos_TheGentlemen_Sept2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1683.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a40e9df-1e12-45ba-9c66-10fa1e66c188
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · Intel471_TheGentlemen_Aug2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0084c8-b0e9-48f2-9e8e-b7aadbdf4788
BradyUnit42_TheGentlemen_July2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f2f6d11-519c-4489-9104-e3d3b72ef3a8
SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59eef083-632d-412d-b8bd-de8ba39c8de6
SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S9051
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6496a2ff-6b46-4ee9-8a92-a04e82ba3be2
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ef4eef0-675f-4217-8ade-811b0608ea90
TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1036.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76db164b-3792-497e-857d-80fdfea6ee46
SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--836ba167-10bd-40ce-8578-bbac18d074ed
BradyUnit42_TheGentlemen_July2026 · Intel471_TheGentlemen_Aug2026 · TrendAI_TheGentlemen_Sept2025 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a9f39a5-628c-4382-a00e-99baa8bbdb4f
BradyUnit42_TheGentlemen_July2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1683.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e232f50-a656-4b8e-8873-ec0530e1635d
BradyUnit42_TheGentlemen_July2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90c4707e-201f-4204-9e99-2e043c451055
TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1585
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9698ce22-f948-4ea6-bd97-bff2c29381ac
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a499a9d0-7508-4b1c-83cd-748d21c34682
BradyUnit42_TheGentlemen_July2026 · Intel471_TheGentlemen_Aug2026 · TrendAI_TheGentlemen_Sept2025 · Sophos_TheGentlemen_Sept2026 · SoučekESET_Gentlemen_Jun2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abcc0249-0226-440b-a32a-02512fd2db4f
Intel471_TheGentlemen_Aug2026ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd395e10-4062-4f79-a510-886bd6264771
BradyUnit42_TheGentlemen_July2026 · CarveyODonnellWelchHuntress_TheGentlemen_May2026 · Intel471_TheGentlemen_Aug2026