The Gentlemen

The Gentlemen is a rapidly expanding ransomware-as-a-service (RaaS) operation that emerged in mid-2025 and became one of the most prominent ransomware brands during the first half of 2026. Microsoft tracks the operators as Storm-2697 and documents a Go-based Windows encryptor with aggressive self-propagation and defense-evasion behavior.

Check Point reports a multi-platform locker portfolio covering Windows, Linux, NAS and BSD in Go plus an ESXi locker in C. The program recruits affiliates and uses double extortion, combining encryption with data theft and public-leak pressure.

Core ransomware capabilities are high-confidence because independent technical sources provide behavior-level evidence. Affiliate-specific tooling, particularly SystemBC, is kept separate from core program capability unless additional evidence establishes centralized integration.