Skip to content

The Gentlemen Ransomware

Software · ATTACK:enterprise:S9051

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S9051",
  "title": "The Gentlemen Ransomware",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9051",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--73526d60-8813-4895-88ac-915c68dfe8dd",
  "external_id": "S9051",
  "domain": "enterprise",
  "created": "2026-09-22T22:53:37.482Z",
  "modified": "2026-09-30T20:43:14.935Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
      "url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
    },
    {
      "source_name": "CheckPointResearch_TheGentlemen_April2026",
      "url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
    },
    {
      "source_name": "MSTI_GentelmenRansomware_May2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
    },
    {
      "source_name": "TrendAI_TheGentlemen_Sept2025",
      "url": "https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"
    }
  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1070.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061d7039-8463-46bc-9f33-ac8153c5cf22

MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1059.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ccb1bf9-94bc-4d0e-8e84-2baf7ddbd483

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1222.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cf9ba59-b44a-4266-918f-c493f1485a76

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f356b7d-a206-4dfd-950f-41abbb85a59f

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1053.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--134c03c1-4b34-4c3c-912a-16792cb01ee2

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21a662a2-7eb9-4cc3-b2d1-984239f8c9a1

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1070.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d3d3ca7-8b5f-496d-b07d-a96acc2bd35a

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1037.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a7a423a-2995-43f7-a152-99af5a552366

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3df5e4b3-a26b-4c8f-bf77-8ae3c602f958

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--432e1354-11a0-4ade-9874-58fa3194b0d1

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5978688d-f172-4af5-bfc6-f62789492766

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1689

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a7cc322-c3b7-48ee-9e5f-6a5f210692ea

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ac99030-a310-4607-bce1-490bf63639a7

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1484.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e82c1c5-21b2-406b-995f-7a1aa6234521

CheckPointResearch_TheGentlemen_April2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S9051

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6496a2ff-6b46-4ee9-8a92-a04e82ba3be2

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e3bfea5-846f-46d4-9383-bdc59768c8f6

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1564.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75aae509-b369-49b7-b6e1-ffbbb16fb67c

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84fd38cb-2310-4cac-abdd-6418223bc51c

MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1037.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8859cfd8-dfa2-4e89-9003-e67a60218442

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1675

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89583dab-3d70-43d9-811a-e14b1d379f4a

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ce1b4b0-da5d-489b-8e95-8c63d2e4dbc4

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8a63b4-b80a-4a93-959e-95fb24ef5ebe

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92579cd5-b0ae-40bc-b4ba-3286d7114d2f

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1690

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--926adcaf-f3e4-42b9-92de-8e9da83234d1

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92a6471a-aee3-459e-b350-6354afcdaaf0

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93adaeae-7fa2-4510-b377-19b82969ff3e

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d757133-336a-491b-807b-5d8c1591cf45

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a370ba06-f0e0-49e7-a1dd-508700403bed

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8ead19f-6ea1-48e0-99e3-71ceb0360fcb

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1491.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaa5dc30-1195-4edd-881e-63934b9f8c4d

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aee6f237-3565-4284-b887-0703f28022d8

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1561.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af3fa17b-e789-4522-af82-663a6d7bcaa3

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2426c20-11cd-4211-a251-4c8e5980fe82

BradyUnit42_TheGentlemen_July2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca493dc3-e2ef-45ee-a352-6c7363bc6c57

CarveyODonnellWelchHuntress_TheGentlemen_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb8133a4-347a-4e81-a866-c60e7ce940a8

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ccd7a6-117e-4d10-bb86-2f9ea6cb911b

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d36642ab-c972-4b23-b528-b25ea835031c

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1686.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e22b3b91-73af-415f-b503-264fcbe75267

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1679

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e5297b-d054-4d89-b950-a5dc49cc4b15

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e823abe8-8edb-4066-adc5-b190af0fb2e1

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e97ea9e0-3988-4135-9c7d-d4e2d1900c34

MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebf22611-e216-4b97-8b8b-04e59c928b95

CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee172624-7e7b-44a2-8808-b7e5b1298c9f

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3f8ff44-e693-4ba6-8ac8-3aa9d2d38969

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdb57199-1097-4e0b-92c9-c578283c12e8

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff83e828-168e-4702-8682-63f8e9633a48

MSTI_GentelmenRansomware_May2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.