THE GENTLEMEN (Storm-2697) - threat report The #2 ransomware operation on the planet right now. Most people…
Lara B. — Building Cyberr
THE GENTLEMEN (Storm-2697) - threat report
The #2 ransomware operation on the planet right now. Most people outside security have never heard the name. :)
The numbers (Jan–May 2026)
→ ~332 victims published on their leak site
→ #2 worldwide by victim count, behind only Qilin
→ ~10% of every ransomware victim posted globally
→ 66+ countries, 20+ sectors
How this is counted: 1 victim = 1 organization the group names on its leak site. Ransomware scale is measured in victims because actual payments stay private.
For scale: DragonForce took ~2 years to pass 150 victims. The Gentlemen did it in 9 months.
Why they scaled so fast - it's a comp story
Industry-standard affiliate split is 80/20. They pay 90/10. The best operators displaced by LockBit/BlackCat takedowns followed the money. A criminal network out-recruited the market by fixing its incentive structure.
The front door
→ FortiGate firewalls (CVE-2024-55591)
→ ~14,700 pre-compromised devices kept on hand
→ ~969 brute-forced VPN creds - passwords like "gentlemen25"
The irony
May 2026: they got breached themselves. 🙃 Their hosting provider was compromised and ~6 months of internal chats leaked - exposing 9 operators, AI-assisted tooling, and the full playbook.
Defender takeaways
→ Patch CVE-2024-55591 now. Treat exposure as compromise.
→ Phishing-resistant MFA on every VPN and privileged account.
→ Immutable, offline, tested backups.
The part that should sit with anyone hiring in security: a ransomware crew built a better talent pipeline than most legitimate teams. They just paid for it.
2 reactions · 0 comments