The Gentlemen

Threat actor

Names and who uses them

The GentlemenOur name
GOLD SHERWOODMITRE ATT&CK
Storm-2697MITRE ATT&CK

Known techniques

T1018Remote System Discovery
T1027.002Software Packing
T1036Masquerading
T1036.001Invalid Code Signature
T1036.005Match Legitimate Resource Name or Location
T1068Exploitation for Privilege Escalation
T1078Valid Accounts
T1190Exploit Public-Facing Application
T1219.002Remote Desktop Software
T1486Data Encrypted for Impact
T1583.001Domains
T1585Establish Accounts
T1585.001Social Media Accounts
T1588.002Tool
T1657Financial Theft
T1683.001Written Content
T1683.002Audio-Visual Content

Source: MITRE ATT&CK

Malware and tools used

Source: MITRE ATT&CK

Security timeline

29 October 2026Activity reported by Cisco TalosTalos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements

Recent news

Cisco Talos· 4d· High

Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements

Talos IR found phishing was the top initial access method at just over one-third of engagements, down from over 50 percent, with vishing and help desk impersonation used to get victims to allow remote access via legitimate RMM tools. Exploitation of public-facing applications, mainly edge devices, accounted for one-third. Ransomware and pre-ransomware activity reached 27 percent, involving The Gentlemen, Qilin, Rhysida, Interlock and the newer VYPR, with EDR disabled via vulnerable drivers or WDAC.

Am I affected?1