The Gentlemen ransomware operation, identified as LARVA-368 (Alexander Andreevich Yapaev), has operated since at least 2020 under aliases like hastalamuerte and zeta88. Yapaev launched what he initially named Phantom Mantis, leveraging other Ransomware-as-a-Service (RaaS) schemes such as LockBit and Qilin to facilitate his attacks. By July 2025, Yapaev transitioned to full independence, rebranding his sophisticated operation to The Gentlemen. This strategic shift was further solidified in August 2025, when a payment dispute with Qilin prompted The Gentlemen to develop and deploy their own custom ransomware, marking a significant step in their evolution as a standalone threat actor.
This highly organized group has since claimed 478 victims globally, demonstrating a clear focus on large enterprises, particularly those running extensive VMware infrastructure. Microsoft, a key player in threat intelligence, tracks this formidable adversary as Storm-2697. Despite their rapid growth, accounting for a notable 10% of global ransomware activity by April 2026, The Gentlemen suffered a critical operational security (OpSec) failure in March 2026. This breach exposed their backend infrastructure, providing researchers with an unprecedented, detailed view into their operations. This significant misstep ultimately led to Yapaev's alleged unmasking, underscoring the profound irony of an advanced cybercriminal group, so adept at external evasion, making such fundamental internal OpSec errors.
The Mechanism of Gentlemen Ransomware: AI-Assisted EDR Killers and a Full Toolkit
The Gentlemen ransomware operation's EDR evasion tactics represent a core technical threat that sets them apart. They provide their affiliates with highly effective EDR killers that leverage the bring your own vulnerable driver (BYOVD) technique. This method exploits legitimate, digitally signed drivers with known vulnerabilities to disable or bypass security agents. While BYOVD is a well-established and challenging method to defend against, The Gentlemen have centralized its development and continuous maintenance, even integrating artificial intelligence (AI) to assist in its rapid adaptation and evolution. These attacks are particularly effective because they exploit inherent trust in signed code, allowing malicious actions to masquerade as legitimate system processes.
Their custom ransomware, meticulously written in Go and obfuscated with Garble, employs robust cryptographic standards, including X25519 key exchange and XChaCha20 symmetric encryption, ensuring data confidentiality. Beyond its core encryption capabilities, the ransomware includes worm functionality, activated via a --spread argument, enabling lateral movement within compromised networks. A --wipe option is also available for post-encryption cleanup, designed to complicate forensic analysis and recovery efforts. The Gentlemen's toolkit extends far beyond just ransomware; it's an extensive arsenal comprising custom Active Directory discovery tools like NetExec, NTLM relay utilities such as RelayKing, privilege escalation tools like PrivHound, and specific evasion tools including EDRStartupHinder, gfreeze, and glinker, all designed to interfere with and disable security products. They also utilize DumpBrowserSecrets for efficient credential theft, further enhancing their post-compromise capabilities.
Initial access for Gentlemen ransomware attacks often originates from exploiting vulnerable internet-facing services. Common targets include critical infrastructure components such as Cisco, Fortinet FortiGate, VMware Aria Operations, or other widely used Microsoft software. They actively leverage known vulnerabilities, with examples including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, to gain a foothold. Once inside, The Gentlemen utilize Velociraptor for command-and-control, systematically clear System, Application, and Security Windows Event Logs to cover their tracks, disable Microsoft Defender, and add antivirus exclusions. This systematic and thorough operational methodology allows them to maintain an average dwell time of two to six weeks before initiating the final encryption phase, providing ample time for reconnaissance and lateral movement.
The Impact: Increased Accessibility, Greater Risk
The practical impact of The Gentlemen ransomware operation is starkly evident, with enterprises, particularly those heavily reliant on VMware infrastructure, being clear and consistent targets. Their documented 478 victims globally serve as a grim testament to their reach and effectiveness. Beyond mere data encryption, The Gentlemen employ aggressive double extortion and multi-channel pressure tactics. These include direct email outreach to victims and their partners, and even phone calls, ensuring that even organizations with robust backup strategies are pressured to pay the ransom to prevent data leaks or further reputational damage.
A key danger posed by The Gentlemen ransomware group is its strategic focus on lowering the barrier to entry for affiliates. Affiliates are incentivized with a generous 90% cut of the ransom payments, alongside a comprehensive package that includes the sophisticated EDR killers, custom ransomware binaries, and dedicated technical support channels (e.g., "The Gentlemen Data" on Tox or SimpleX Chat). This centralized development model, significantly augmented by AI, enables rapid response capabilities. A prime example of this agility was observed in April 2026, when The Gentlemen released a patch for their ransomware on the very same day a decryptor for an earlier version was made public. This accelerated development cycle, heavily assisted by AI, contributes significantly to their sustained success and adaptability in the ever-evolving threat landscape.
Yet, despite being a well-organized and technically proficient group, The Gentlemen also suffered a notable internal breach. This exposure laid bare their backend infrastructure, victim management systems, and internal communications, including an open directory containing 126 of their proprietary tools. This profound internal exposure provided invaluable insight for researchers into their intricate operations and starkly demonstrated that even advanced groups like The Gentlemen ransomware collective have critical vulnerabilities in their own operational security. This incident has prompted extensive analysis into how a group so meticulously focused on external evasion could experience such a significant and profound internal failure, offering crucial lessons for both offensive and defensive cybersecurity strategies.
Defensive Posture and Operational Insights
The alleged unmasking of Yapaev and the detailed insights gained from The Gentlemen's internal breach offer a significant intelligence gain for the cybersecurity community. These events provide a unique opportunity to understand the inner workings of their operations, which is highly beneficial for developing more effective defense strategies against Gentlemen ransomware and similar threats. This intelligence allows defenders to anticipate tactics, techniques, and procedures (TTPs) and build proactive defenses.
Strengthening initial access vectors is paramount in defending against The Gentlemen ransomware. Effective defenses involve diligent and continuous patching of all internet-facing services, especially those commonly exploited by the group, such as Cisco, Fortinet, VMware Aria Operations, and various Microsoft software. These platforms are frequently targeted entry points. Furthermore, robust credential hygiene practices, including regular password rotations and the mandatory implementation of multi-factor authentication (MFA) across all systems, are essential to prevent unauthorized access and lateral movement within networks.
Regarding EDR solutions, recognizing BYOVD as a known and persistent technique is key. While EDR solutions are undeniably vital components of a modern security stack, they should not be considered a singular defense. Supplementary measures are crucial: actively monitoring for unauthorized driver installations, utilizing driver blocklists where technically feasible, and implementing integrity checks on security agents to detect tampering are critical. Network segmentation remains a foundational security principle, limiting the blast radius of any successful breach. Finally, a robust, regularly tested, and immutable backup strategy is an indispensable defense, ensuring business continuity even in the face of a successful Gentlemen ransomware attack. The intelligence shared by entities like Microsoft (tracking Storm-2697) and independent researchers provides a foundational understanding, but organizations must actively integrate these insights into their dynamic defense strategies to stay ahead of evolving threats like Gentlemen ransomware.
The Gentlemen ransomware operation exemplifies a technically proficient adversary that also exhibits notable operational security weaknesses. Their innovative use of AI assistance in developing and maintaining EDR killers significantly lowers the barrier for affiliates, making them a continuous and adaptable threat. However, the exposure of their internal operations and the alleged unmasking of their leader, Alexander Andreevich Yapaev, unequivocally prove that even with advanced tooling and sophisticated tactics, human error and fundamental OpSec failures can ultimately lead to their downfall. Understanding both their technical prowess and their operational security mistakes provides critical intelligence for building more effective, multi-layered defenses against the persistent threat of Gentlemen ransomware.
