The Gentlemen Ransomware Recovery Guide

The Gentlemen (tracked in some threat intelligence as Storm-2697) is a fast-growing ransomware-as-a-service operation that surfaced around July–August 2025 and reportedly linked well over a thousand victims within its first year, helped by an unusually high 90% affiliate revenue share.

Its custom Go-based malware runs against Windows, Linux, NAS and BSD systems. What sets it apart is documented post-compromise behaviour that specifically includes destroying Veeam backup repositories, compromising hypervisors and shutting down databases before encrypting — not incidental damage, but a deliberate sequence aimed at removing the easy recovery options first.

Because Veeam repositories, NAS devices, hypervisor hosts and databases are direct targets rather than afterthoughts, recovery after this group typically has to work at each of those layers independently — assessing the repository storage itself (even a targeted VBK can sometimes still yield recoverable content), the NAS volumes, the ESXi/Hyper-V datastores and the database files separately, rather than assuming a single restore point covers everything. Preserve current state and get each system assessed before attempting any restore.