Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

3 IOCs

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Microsoft Threat Intelligence

Published May 28, 2026Original Report

Threat Actors

Malware Families

Excerpt

In this article Pre-encryption File encryption Post-encryption Defending against The Gentlemen ransomware Microsoft Defender detections and hunting guidance Indicators of compromise Ransomware that combines robust encryption with rapid lateral movement significantly increases the risk and impact of an attack. The Gentlemen ransomware is a ransomware-as-a-service (RaaS) threat that is distinguished by its ability to pair its strong per-file encryption with an aggressive…

Read the original report →

Diamond Model

Adversary(1)

Infrastructure

Capability(2)

Victim

Attack Flow6 steps · MITRE ATT&CK mapped

ExecutionTA0002T1059

1/6

Command and Scripting Interpreter

ActionControl execution via command-line

The ransomware operator controls the encryptor via command-line arguments, including a password for execution and optional parameters for encryption scope, speed, and lateral movement.

Indicators of Compromise

Open the mindmap →

3 indicators

Type	Indicator	Confidence	Score	First Seen
SHA256	22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67	Medium	Score 53/100	First seen Jun 2, 2026
SHA256	fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68	Medium	Score 53/100	First seen Jun 2, 2026
SHA256	078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b	Medium	Score 53/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…