The Gentlemen Ransomware Claims 478 Victims

The Gentlemen ransomware operation (tracked as Phantom Mantis and Storm-2697) has emerged as a significant threat since March 2025, claiming 478 victims globally. Led by a Russian-speaking actor known as LARVA-368, the group transitioned from an affiliate of LockBit, Qilin, and Medusa into an independent Ransomware-as-a-Service (RaaS) platform. The group is notable for its use of artificial intelligence in tool development and a highly responsive development cycle that includes same-day patching of cryptographic vulnerabilities.

Technically, the group employs a multi-platform Go-based encryptor capable of targeting Windows, Linux, and ESXi environments. A critical feature of their tradecraft is the use of a '--spread' argument which transforms the ransomware into a self-propagating worm. Their infrastructure leverages diverse messaging platforms like Tox and Ricochet, and they maintain strict operational security by requiring potential affiliates to provide stolen data before gaining access to their panel.

The group's rapid adaptation, use of 'Bring Your Own Vulnerable Driver' (BYOVD) techniques, and focus on enterprise edge devices (Cisco, Fortinet) pose a severe risk to global sectors. While only 13% of victims are U.S.-based, the group's demonstrated ability to exploit N-day vulnerabilities like CVE-2024-55591 and CVE-2025-33073 makes them an urgent priority for defenders.