The Gentlemen ransomware hits LATAM

Executive summary

The Gentlemen became one of the most active ransomware operations in the criminal market in 2026, with metrics that consistently place it among the highest-volume actors in claimed victims. Consolidated reporting describes it as a human-operated ransomware-as-a-service operation, tracked by Microsoft Threat Intelligence as Storm-2697, with a formal shift to an affiliate model in September 2025. Through 2026, it went from a recent arrival to large-scale activity, with hundreds of victims listed on its leak site and a steady rise in published claims.

The most stable feature of the campaign is double extortion. In practice, The Gentlemen enters corporate networks, exfiltrates sensitive data, encrypts critical systems, and then threatens to publish the stolen information if payment is not made. Several analyses added that in some cases the group escalated pressure further, using countdown timers on its leak site, partial document releases, and, in some reports, DDoS threats. That puts it at a more aggressive operational tier than classic ransomware focused only on downtime.

The technical expansion was just as clear. The group used a Go-based encryptor obfuscated with Garble, with builds for Windows, Linux, BSD, NAS, and ESXi, and with algorithms such as XChaCha20 and Curve25519 in different related families. Around that core, the operation added evasion and defense-disruption techniques, including shadow copy deletion, PsExec and WMI abuse, antivirus disabling, and BYOVD-compatible mechanisms. In practical terms, this means an intrusion chain built around persistence, reconnaissance, and the removal of barriers before encryption.

Its target profile is also consistent. Sources cite sectors including manufacturing, healthcare, finance, construction, energy, retail, technology, education, insurance, and government. Geographically, the consolidated evidence shows claims across North America, South America, Europe, Africa, and Asia, with visible presence in Mexico, Colombia, Peru, Chile, Argentina, and Brazil. This is not just a global actor, but one that found a concrete opportunity surface in Latin America, especially where exposed services, weak credentials, unpatched VPNs, and low tolerance for disruption converge.

On the defensive side, the most repeated signal is that The Gentlemen does not depend on a single vector. It combines edge exploitation, purchased access, phishing, exposed RDP, and abuse of remote administration tools. That mix, combined with the speed of pre-encryption exfiltration, makes detection based only on the moment ransomware detonates arrive too late. The real hunting window comes earlier, in VPN telemetry, bursts of mass file reads, unusual admin sessions, and the appearance of reconnaissance and defense-manipulation tools.

Context and background

The Gentlemen appears in the material as an operation that emerged in mid-2025, with early references ranging between July and August of that year. ManageEngine, FortiGuard, Mallory.ai, DysruptionHub, BlackFog, Halcyon, Ransomware.live, and other profiles agree that it is a RaaS operation, with a gradual shift from a closed phase to a more public affiliate model. Some reports place that formal opening in September 2025. Others note that its origin may lie in the evolution of ArmCorp, a former Qilin affiliate, reinforcing the reading of an ecosystem under fragmentation and of operators with prior experience moving between groups.

That background matters for two reasons. First, it explains how quickly the group was able to scale. Second, it helps explain why its playbook mixes traditional ransomware tactics with more sophisticated exfiltration, C2, and evasion infrastructure. Rather than a static toolkit, the material shows an operation that adapts its chain to each victim’s exposed surface, but always around the same business logic: monetize access, leak data, and force negotiations.

The material also shows that the group did not rely on a single malware family. There are references to a Go-based encryptor obfuscated with Garble, a multiplatform toolkit for Windows, Linux, ESXi, BSD, and NAS, additional lockers, self-propagating variants, and evasion modules using malicious drivers. Among the most consistent observations are the use of GentleKiller, PoisonX3.sys, PoisonX4.sys, and anticheatG13.sys, all designed to weaken security solutions before encryption is executed.

Key facts table

Operation timeline

Attack chain and TTPs

The operational pattern that emerges from the research is consistent and not improvised. Initial access usually comes through the perimeter, not through an isolated endpoint. Cyware identifies three recurring vectors, Citrix NetScaler ADC (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766), and Fortinet FortiOS (CVE-2024-55591). Security Arsenal broadens the picture with Check Point and Cisco Secure Firewall, plus ConnectWise ScreenConnect (CVE-2024-1708). Added to that are stolen or purchased credentials, exposed RDP, phishing campaigns with macro-enabled documents, and abuse of remote administration services such as ScreenConnect or RMM-style tools.

Once inside, the operation aims for persistence and reconnaissance. Intel471 describes the playbook as entry through Internet-exposed services, network mapping, identification of domain admin accounts, disabling of security tools, and payload distribution through NETLOGON. DataEnforce, meanwhile, points to mass document reading or downloading from a single account, lateral access to repositories across multiple subsidiaries, anomalous VPN authentications, and sustained transfers to unknown cloud endpoints. That suggests a clear focus on the pre-encryption stage, when containment is still possible.

Defense disruption is another key trait. Cynet documented the use of PoisonX3.sys and PoisonX4.sys, installed as services under HKLM\SYSTEM\CurrentControlSet\Services\PoisonX, to manipulate processes, network, files, and memory in order to terminate security services. Cybersecurity News adds anticheatG13.sys, a kernel driver used to terminate almost 180 security-related processes. Security Arsenal mentions shadow copy deletion with vssadmin or wmic, disabling backups and antivirus, and behavior consistent with BYOVD. That set is not incidental, it is central to opening the path to encryption.

The ransomware itself is also well characterized. ManageEngine, DataEnforce, Infobae, Mallory.ai, and DEFOnline agree on the use of Go and Garble obfuscation. According to the sources, the encryptor has builds for Windows, Linux, BSD, NAS, ESXi, and virtualized environments, and in some cases requires a specific password to run. That limits uncontrolled spread and complicates sandbox analysis. RST Cloud and Mallory.ai add the use of XChaCha20 and Curve25519, while DEFOnline highlights aggressive self-propagation capabilities inside the compromised network.

Exfiltration usually precedes encryption by 48 to 72 hours, according to Security Arsenal, and total dwell time in the network ranges from 4 to 14 days before detonation. That window is especially important for detection and response, because the pre-encryption activity is where the most exploitable patterns appear, such as service enumeration, mass reads, lateral movement, and log wiping. The model is not built around an instant strike. It is built around progressively degrading defenses so that the extortion phase begins with as much control and as much stolen data as possible.

Regional impact

Regional overview

The regional footprint of The Gentlemen is broad and well documented in the material. This is not an actor focused on a single geography, but an operation that found fertile ground in multiple markets at once. Aggregated sources place it with victims in North America, South America, Europe, Africa, and Asia. Within that map, Latin America stands out as a particularly exposed zone, both because of specific victims and because of tactics that exploit surface areas common in the region, such as Fortinet FortiGate, exposed RDP, unpatched VPNs, and overly privileged administrative accounts.

The Latin American pattern is not uniform. In some cases, such as Ecopetrol, there is partial corporate confirmation and subsequent regulatory alerts. In others, such as Oldelval, the incident was operationally contained but remained a public claim by the group. In Peru, the Municipality of San Luis appears in several records as a leak-site listing, but without official breach confirmation. In Chile, Grupo Minero Las Cenizas was marked as an unconfirmed claim. In Brazil, Intranet Gov Brasil appears as a leak-site post still lacking confirmation from authorities. Mexico, meanwhile, was exposed through an intrusion against Advanced Marketing, also without all technical details released.

Colombia

Ecopetrol is the most relevant regional case and also the most difficult to verify fully. On July 17, 2026, the company detected irregular access that led to unauthorized downloads of data linked to roughly 3,300 user accounts and cloud environments belonging to 15 group companies. Available reporting agrees that there was no mass encryption or direct impact on production operations, but there was data exfiltration and a later public extortion attempt.

The Gentlemen claimed on its site to have exfiltrated more than 1 TB and 65 million documents. That figure, however, was not independently validated and should be treated as the actor’s claim. What matters from a regional defense perspective is that the case confirmed the combination of irregular access, extortion pressure, and information publication, and prompted official responses. ColCERT issued a high-risk alert for Colombia’s business sector on July 18, 2026, and reinforced recommendations for urgent patching of Fortinet FortiGate devices, other VPNs, and mandatory two-factor authentication.

The case also helped cement the public association between The Gentlemen and a perimeter-focused intrusion model. DataEnforce described the incident as an intrusion publicly attributed in reporting to the group and recalled that ColCERT had already linked The Gentlemen to more than 200 attacks in 50 countries by April 2026. In narrative terms, Ecopetrol became a trigger for greater regional visibility for an operation that was already expanding.

Argentina

Oldelval appears as the strongest Argentine case in the material. The company was listed by The Gentlemen on July 23, 2026, with a reference to the exfiltration of internal files during a ransomware attack. Public reports indicate that the company did not issue a detailed breach notice and that the number of affected individuals and the volume of compromised data remained unknown. Even so, the company’s communication to the National Securities Commission described an impact limited to administrative systems, while crude oil transport continued without interruption and the incident was declared fully contained.

On the technical side, DEFOnline describes the associated malware as developed in Go, obfuscated with Garble, and capable of aggressive self-propagation inside the network, with fast hybrid encryption based on Curve25519 and XChaCha20. The Rio Times and FalconFeeds added the context of a public claim by the group, but without official attribution confirmation. The analytical value of the case is that it shows a scenario where operational continuity is preserved, but the administrative surface is exposed and pressure from the leak site remains active.

Chile

Chile appears in the material as a geography with several claims, but little public confirmation. Security Chu mentioned alleged confirmed attacks against La Cámara Seguros, the INDH, and Corporación Colina, though without technical details or independent validation. The most concrete case is Grupo Minero Las Cenizas, listed by The Gentlemen on July 31, 2026, with an assertion of internal file exfiltration. GalaxyWarden specified that the entry did not detail the number of records or the types of information stolen and that the incident remained unconfirmed because the company had not issued a breach notification.

Chile’s value in this corpus is methodological. It shows how leak sites can include corporate or institutional names that then circulate through media and aggregators without official confirmation. For an intelligence team, that requires separating actor claims, media mentions, and validated facts immediately.

Peru

The Municipality of San Luis, in Lima, was listed by The Gentlemen on July 31, 2026. GalaxyWarden, Dexpose, Hookphish, Ransomware.live, RecentBreaches, and BreachSense agree that this was an actor claim with a threat to publish sensitive data, but without official breach confirmation from the municipality. Ransomware.live recorded 38 compromised users, though there is still no publicly verifiable detail on the scope of the leak.

What makes the case interesting is the convergence between what was reported in the media and what appeared in the group’s narrative. There was also an earlier post on X that mentioned a hack of the municipality’s computer systems on July 24, with temporary impact on online queries and payments and the activation of recovery protocols. That does not confirm attribution, but it does reinforce the idea that local service platforms are a frequent pressure point.

IntelFusions also said that between July 30 and 31, The Gentlemen posted new victims, including municipal governments in Brazil and Peru, amid a spike in activity. In regional terms, Peru therefore sits in an environment where the operation combines leak-site claims with low official visibility and possible exposure of municipal infrastructure.

Brazil

Brazil is another recurring focus in the material. The Intranet Gov Brasil case, listed on August 7, 2026, was presented by The Gentlemen as an intrusion into the internal network and digital portal used by the Brazilian federal government. GalaxyWarden and Ransomware.live clarified that, at the time of publication, there was no public confirmation from the government or from Serpro or Dataprev, and classified the case as an unconfirmed claim.

The value of this record lies in the combination of institutional sensitivity and lack of validation. It is a clear example of how a leak site can try to amplify the impact of a claim in government environments to force media attention, even when the available evidence is limited to the actor’s own announcement. IntelFusions also noted that during July 30 and 31 the group posted municipal governments in Brazil and Peru during a wider activity spike, suggesting the region was being pushed more aggressively at that point.

Mexico

Mexico appears through Advanced Marketing, a books distribution and publishing company with the domain advmkt.com.mx, listed by The Gentlemen on July 25, 2026. GalaxyWarden, Dexpose, and HackerFeeds agree that there was a direct claim by the group, with a threat to leak sensitive data if negotiations did not begin. Some aggregators classified the case as medium severity, but by late July no ransom amount, data volume, or detailed technical indicators had been published.

The relevance of the incident is tactical. GalaxyWarden notes that The Gentlemen often targets mid-sized companies in Latin America and Europe through phishing or exploited RDP services, followed by rapid exfiltration of sensitive files before encryption. That approach fits many mid-market Mexican organizations, where exposed perimeter services and remote access management remain high-yield entry points for ransomware operators.

United States

The United States appears in multiple sources as both a priority market and a source of specific victims. Mallory.ai identified Control Concepts Technology, based in Texas, as a ransomware victim attributed to The Gentlemen, and TopMark Funding, based in California, as another data breach linked to the group. It also reported Kenaitze Indian Tribe in Alaska as a victim dated July 31, 2026, along with other U.S. organizations such as Promatrix.

Security Arsenal said that within a batch of 25 new victims, Germany and the United States were the group’s primary markets, with entities ranging from 50 to 500 employees. BankInfoSecurity and S-RM also placed The Gentlemen among the prolific operations before it suffered its own internal leak. Although the focus of this investigation is Latin America, the United States serves as an operational reference for the actor’s maturity and scale.

Countries without enough verifiable coverage

No additional verifiable facts were identified in the research for Paraguay, Bolivia, or Uruguay, and Mexico did not provide a second case beyond Advanced Marketing.

Technical indicators

The Gentlemen has an unusually rich public technical footprint for a relatively young RaaS operation. Halcyon publishes locker hashes, the leak site URL, and behavioral patterns for the Go binary. Ransomware.live documents 42 IoCs associated with the operation. Cynet provided hashes for the PoisonX3.sys and PoisonX4.sys drivers. Gurucul and Hunt.io added affiliate infrastructure with domains, IPs, and EtherRAT components. Cyfar.ca expanded the set with hashes, IPs, and command-line fragments.

The absence of some complete values, such as the exact leak site URL in all sources or the full hashes of every published sample, does not reduce the utility of the set. For defense, there are already enough infrastructure and behavior indicators to strengthen detection rules in DNS, proxy, EDR, and exposed-service monitoring.

Analysis for security teams

The defensive priority against The Gentlemen is not the moment of encryption, but the hours and days before it. The material shows that the actor often remains in the network for 4 to 14 days before detonation and begins exfiltration 48 to 72 hours before encryption. That means any reconnaissance, lateral access, or mass-read behavior appearing on administrative accounts or unusual VPN connections should be treated as high-value signal.

The first mitigation block should focus on the access surface. The research is very clear about Fortinet FortiGate, FortiOS, FortiProxy, Citrix NetScaler ADC, and SonicWall SSL VPN. ConnectWise ScreenConnect, compromised RMM tools, and exposed RDP also appear. In practical terms, that means patching with high priority, reviewing public exposure of remote consoles, cutting unnecessary access, and checking multifactor authentication on every entry point. The Colombian case shows that edge-appliance exploitation remains a high-return door for the actor.

The second block is behavioral detection. DataEnforce lists highly actionable signals, such as mass reading or downloading by a single account, access to repositories across multiple subsidiaries, anomalous VPN authentications, Advanced IP Scanner or Nmap execution from administrative contexts, sustained outbound transfers to unknown cloud endpoints, and attempts to disable endpoint protection or delete logs. Add to that vssadmin, wmic, PsExec, WMI, NETLOGON, strange service creation, unusual or unsigned kernel drivers, and any BYOVD pattern. If the organization has well-tuned EDR telemetry, The Gentlemen leaves a fairly recognizable sequence before encryption.

The third block is impact containment. The use of a Go payload with a specific password suggests an operator trying to avoid uncontrolled spread, while still pointing to deliberate deployment across multiple hosts. Privileged access should be segmented, cross-repository read access reduced, excessive cloud permissions reviewed, and backup access hardened. Security Arsenal and Cynet show that shadow copy deletion and security-tool tampering are part of the chain, so backup protection must be treated as a primary attacker target, not an auxiliary asset.

The fourth block is active hunting for affiliate infrastructure. Gurucul, Hunt.io, and CyberPress show that The Gentlemen does not operate only with the encryptor, but with staging, reverse shell, C2, and exfiltration tools supported by specific domains and IPs. The EtherRAT case, moreover, introduces a C2 component via Ethereum smart contracts, which complicates purely perimeter-based blocking. For SOC teams, that means DNS, proxy, and egress telemetry matter just as much as endpoint data.

The tactical priority, then, is this order, patch edge surfaces, enforce MFA on remote access, monitor exfiltration and administrative behavior, harden privileges, protect backups, and hunt for abnormal drivers or services. In Latin America, where many of the actor’s intrusions rely on exposed perimeters and reused credentials, that order is more useful than any generic ransomware rule.