The Gentlemen Ransomware: What It Is, How It Attacks and How to Defend Against It

The Gentlemen ransomware is one of the fastest-growing ransomware operations of the past year, and despite the polite name, there is nothing courteous about it. Since appearing in mid-2025, the group has built a reputation for stealing data first, switching off security tools second, and encrypting everything third. In this guide we explain what The Gentlemen ransomware is, how its attacks tend to unfold, and what UK organisations (including those running operational technology) can do to reduce their exposure.

If you have watched Guy Ritchie's The Gentlemen on Netflix, you will know the type: well-dressed, well-spoken and not to be trusted with your business. His other 2024 release, The Ministry of Ungentlemanly Warfare, is closer to how this group actually operates: a small, unconventional team that strikes from unexpected directions and ignores the rules of a fair fight. Fun names aside, the risk is real, so here is what UK organisations need to know.

What is The Gentlemen ransomware?

The Gentlemen ransomware is a Ransomware-as-a-Service (RaaS) operation that first appeared around mid-2025. Its operators build the encryption tooling and leak infrastructure, and affiliates carry out the actual intrusions in exchange for a share of the ransom.

The group uses double extortion: it steals sensitive data, encrypts systems, then threatens to publish the data if the victim does not pay. Its ransomware has been reported to run on Windows, Linux and VMware ESXi systems, which means servers and virtual infrastructure are in scope, not just staff laptops.

Who is behind The Gentlemen ransomware group?

Several security vendors report that the group grew out of an earlier affiliate crew, known as ArmCorp, that worked with the Qilin ransomware operation. In our professional opinion, that history explains why the group looked so polished so quickly. A brand-new gang rarely launches a working affiliate platform within weeks, but experienced operators changing brands often do.

The group is generally assessed as Russian-speaking, and researchers note it reportedly avoids targeting organisations in Russia and other CIS countries. It is also tracked under other names, including Thegentlemen and Storm-2697. Public reporting suggests a structured team of roughly 20 people, with an advertised affiliate payout of up to 90%.

In May 2026, the group's administrator acknowledged that an internal backend database had leaked. The leaked chats gave researchers a rare look at how the group plans intrusions, and they also showed how closely the operators study other gangs' mistakes. The group has since rebuilt and carried on.

How does The Gentlemen ransomware attack work?

The Gentlemen ransomware attack chain follows a familiar enterprise ransomware pattern, executed with discipline. Based on published research, it usually runs in three broad stages.

Stage 1: Getting in through the network edge

The most commonly reported entry point is internet-facing remote access equipment, particularly Fortinet devices. Researchers have linked the group to exploitation of CVE-2024-55591 (an authentication bypass in FortiOS and FortiProxy), as well as to stolen or brute-forced VPN credentials. Leaked chats also point to compromised Fortinet credentials as a recurring starting point.

In our experience, this is the part that should worry defenders most. Edge devices and VPNs are exactly where IT networks meet remote engineering access, and exactly where we most often find patching gaps.

Stage 2: Switching off your defences

Once inside, the group works to blind security tooling before it encrypts anything. Researchers describe multiple "EDR killer" variants, abuse of legitimate administration tools, and attempts to interfere with backups and recovery. Some analysis also reports vulnerable-driver techniques (known as BYOVD) used to disable endpoint protection.

Stage 3: Stealing data, then encrypting at scale

Data is typically staged locally and then pulled out with common tools such as WinSCP or Rclone. The ransomware is then reportedly pushed to domain-joined machines through Group Policy, so many systems are encrypted at the same moment. Victims report ransom notes named README-GENTLEMEN.txt.

In our professional opinion, none of these individual techniques is exotic. What makes the group dangerous is the speed and the order of operations: exfiltrate first, disable defences second, detonate last.

Who does The Gentlemen ransomware target?

The Gentlemen ransomware targets medium and large organisations across many sectors, including manufacturing, healthcare, technology, construction, insurance and financial services. Reporting shows particular activity in the Asia-Pacific region, as well as Europe and the United States. Check Point Research placed it as the second most productive RaaS operation among those that publish victims, and by April 2026 one incident response firm counted more than 340 organisations on its leak site.

The best-known critical infrastructure case so far is Complexul Energetic Oltenia, Romania's largest coal-based energy producer. On 26 December 2025 the company reported a Gentlemen ransomware attack that disrupted its business IT systems, including ERP and email. The company stated that national energy system operations were not endangered, and public reporting describes the impact as being on the IT side. We would treat that detail carefully, because it is a useful reminder of how IT compromise can still cause real operational pain for an infrastructure operator.

Is The Gentlemen ransomware a threat to OT and railway networks?

In our professional opinion, yes, indirectly, and that is enough to take it seriously. We are not aware of any publicly confirmed case of The Gentlemen ransomware encrypting railway signalling or train control systems, and we do not want to overstate the risk. But rail operators and their suppliers share the same exposed attack surface as everyone else: corporate IT, VPN concentrators, remote access for engineers and third-party maintenance connections.

Based on our experience in IT and OT railway environments, ransomware rarely needs to touch the OT network to cause harm. If the business IT side is taken down, ticketing, scheduling, asset management and engineering file access can all be disrupted. Operators may then choose to isolate OT as a precaution. We saw the same dynamic play out in the WannaCry attack on Deutsche Bahn, which we covered in our lessons from WannaCry blog. Rail organisations preparing for new regulation should also look at our guide to IEC 63452 and railway cybersecurity regulations.

Is there a decryptor for The Gentlemen ransomware?

Not reliably. Where public decryption tools have appeared, the group has reportedly updated its malware soon afterwards, so they tend to be short-lived. In our professional opinion, nobody should plan their recovery around a decryptor. The dependable safety net is clean, tested, offline backups, supported by a recovery plan your team has actually rehearsed.

How can you protect your organisation from The Gentlemen ransomware?

The best protection against The Gentlemen ransomware is closing the doors it is known to use and making sure you would notice if someone walked through. Based on our experience, these are the priorities we would put first:

• Patch and harden edge devices: Prioritise Fortinet and other VPN/firewall devices, fix CVE-2024-55591 and any other known-exploited vulnerabilities, and remove management interfaces from the public internet.

• Protect remote access with MFA: Enforce phishing-resistant multi-factor authentication on every VPN and remote access route, and reset credentials if a device was exposed while unpatched.

• Segment IT from OT: Keep engineering networks behind properly controlled boundaries so a business IT compromise cannot become an operational one.

• Protect your backups and hypervisors: Keep offline or immutable copies, restrict access to ESXi and backup consoles, and test restores regularly.

• Monitor for the warning signs: Watch for security tools being disabled, unexpected use of WinSCP or Rclone, unusual Group Policy changes and large outbound transfers.

• Rehearse your response: Run a tabletop exercise for a ransomware scenario that includes a data-leak threat, not just encryption.

The UK's National Cyber Security Centre (NCSC) publishes free ransomware guidance that is a good baseline for all of the above.

What should you do if you suspect a Gentlemen ransomware attack?

If you suspect an attack, isolate affected systems from the network, preserve evidence, and call your incident response provider before you do anything else. Do not wipe machines or restart servers in a panic, because you may destroy evidence. Report the incident to the NCSC and Action Fraud, and remember that UK GDPR requires reporting certain personal data breaches to the ICO within 72 hours. Be cautious about paying: payment does not guarantee data deletion, and the UK government has announced plans to restrict ransom payments by public sector and critical national infrastructure bodies, so check the current position with your legal advisers.

Frequently asked questions about The Gentlemen ransomware

What does The Gentlemen ransomware do?

It steals an organisation's data, disables security tools, encrypts systems and then demands a ransom, threatening to publish the stolen data if the victim refuses.

When did The Gentlemen ransomware first appear?

Researchers place its emergence around mid-2025, with infrastructure likely running from July 2025 and public victim listings from early September 2025.

Is The Gentlemen ransomware a RaaS?

Yes. It is advertised on underground forums as Ransomware-as-a-Service, recruiting affiliates and offering them a large share of the proceeds.

How does The Gentlemen ransomware get into networks?

Most reporting points to internet-facing remote access devices, especially Fortinet products, along with stolen or brute-forced VPN credentials.

Does The Gentlemen ransomware affect Linux and VMware ESXi?

Yes. Vendors report that the ransomware can run on Windows, Linux and ESXi, which puts servers and virtualised infrastructure at risk.

Has The Gentlemen ransomware attacked critical infrastructure?

It has been linked to the December 2025 attack on Romanian energy producer Complexul Energetic Oltenia, where business IT systems were disrupted. We are not aware of confirmed attacks on railway control systems.

Can you remove The Gentlemen ransomware and recover your files?

Removal does not bring files back on its own. Recovery usually depends on clean backups and a proper incident response process, because decryptor availability is unreliable.

Is The Gentlemen ransomware a risk to UK organisations?

It is a global operation that targets sectors found across the UK, and it relies on techniques (exposed edge devices and weak credentials) that apply to any UK network, so we would treat it as a relevant risk.

Final thoughts

The Gentlemen ransomware is a good reminder that the most effective attackers are often the most disciplined, not the most inventive. Patch the edge, lock down remote access, separate IT from OT, and protect your backups, and you remove most of what this group relies on. In short, ungentlemanly attackers call for disciplined defenders.

If you are not sure how exposed you are, you do not have to work it out alone. At Complete Cyber, we help UK organisations, including rail and critical infrastructure operators, stress-test their defences before an attacker does. Whether it is a quick conversation about your remote access setup, a ransomware readiness review, or support from our incident response and IT/OT cybersecurity teams, we are happy to help. Book a free consultation and let's talk it through.