The Gentlemen
Threat Actor
The Gentlemen (tracked by Microsoft as Storm-2697) is a financially motivated Ransomware-as-a-Service (RaaS) cybercriminal group that emerged in mid-2025. Known for utilizing a double-extortion tactic—encrypting enterprise files while exfiltrating sensitive data to threaten public leaks—the group has quickly grown into one of the most active threat operations globally.
Incidents Associated with this Threat
- July 17, 2026: Cyberattack at Ecopetrol, Colombia Energy Provider
Malware Used by this Threat Actor
No malware identified for this threat actor.