APT / StateG1058

The Gentlemen

Also known as: GOLD SHERWOOD, Storm-2697

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity42

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 17

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Establish Accounts Social Media Accounts Tool Written Content Audio-Visual Content

Initial access

Exploit Public-Facing Application

Privilege escalation

Exploitation for Privilege Escalation

Discovery

Remote System Discovery

Command and control

Remote Desktop Software

Impact

Data Encrypted for Impact Financial Theft

stealth

Software Packing Masquerading Invalid Code Signature Match Legitimate Resource Name or Location Valid Accounts

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

The Gentlemen uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →