Historical intelligence backfill. This assessment covers reporting originally published on 2026-05-28 and was added to the RWP archive on 2026-09-07.
The Gentlemen encryptor was a Go worm with a password — Storm-2697 sold the rest as RaaS
Microsoft's May 2026 teardown names Storm-2697 as the operators, documents Garble-obfuscated Go, per-file Curve25519/XChaCha20, and an SMB --spread flag.
Bottom line up front
CONFIRMED On 28 May 2026 Microsoft attributed The Gentlemen RaaS operators to Storm-2697. Family emerged mid-2025, opened to affiliates September 2025, later recruited via BreachForums. Encryptor is Go, obfuscated with Garble. Per-file ephemeral Curve25519 plus operator-embedded public key, XChaCha20 for content — decryption without the operator key is not practical. CLI requires a password (anti-sandbox); --spread copies over SMB with harvested domain creds; --full hits local SYSTEM volumes and mapped shares. Microsoft-observed victims: education, transportation, healthcare, finance across multiple continents. Kaspersky independently describes the Go backdoor staged a day before encryption and the same hybrid crypto.
Historical backfill of 28 May 2026 reporting; added 7 September 2026.
What happened
This is not "another ChaCha locker." The product is lateral movement built into the encryptor so affiliates do not have to hand-walk every host. CSO's summary of Microsoft matches the --spread / --full flags.
Why it mattered
EDR that only watches the beachhead loses the rest of the floor in minutes. Password-gated execution means a lot of sandboxes record a clean exit.
Who / what was affected
Microsoft-named industries/regions. No confirmed OT/process compromise in these sources — UNKNOWN for ICS.
Technical context
Hunt Go binaries with Garble-style symbol stripping, SMB copies of unknown EXEs, and encryptors that die without a CLI password. Credential hygiene and SMB signing/segmentation matter more than a YARA for one build.
Exploitation / threat status at the time
CONFIRMED Microsoft operator name, crypto, spread flags.
REPORTED Kaspersky pre-ransom Go backdoor.
What defenders should have done
- Block workstation-to-workstation SMB admin.
- Assume domain creds in the encryptor command line if you see
--spread. - Do not rely on automated detonation without the password argument.
RWP assessment
Confidence: High on Microsoft+Kaspersky overlap. Self-propagating encryptors are how RaaS industrializes.
Defensive actions
- Tier-0 creds never on user workstations.
- Canaries on file shares.
- Tabletop from one beachhead to campus encryption without a human operator.
Sources
- Microsoft Threat Intelligence — The Gentlemen ransomware: self-propagating Go encryptor
- Kaspersky Securelist — The Gentlemen RaaS
- CSO Online — The Gentlemen are coming for your files, and then your network