Sophos Counter Threat Unit has published new research into The Gentlemen ransomware-as-a-service operation, run by the threat group CTU tracks as GOLD SHERWOOD.
The analysis of 15 intrusions reveals a practical, fast-moving affiliate playbook that combines compromised credentials, remote access abuse, legitimate admin tools, data exfiltration, EDR killing and backup tampering before ransomware deployment.
The Gentlemen RaaS scheme emerged in mid-2025 and uses a double-extortion model, stealing data before encrypting files.
By the end of July 2026, 683 victim names had been posted to the operation’s leak site, with July alone accounting for 169 victims.
In the 15 incidents analysed by CTU researchers, some affiliates deployed ransomware in less than 24 hours after the first observed post-compromise activity, while the median time to deployment was approximately two days.
The research shows that The Gentlemen affiliates do not need especially novel malware to cause major damage. Instead, they rely on a well-practised sequence of actions: gaining access through exposed or weakly protected remote access services, escalating privileges with native Windows utilities, staging tools in trusted locations such as C:\PerfLogs, stealing data with tools including Rclone, Restic and MinIO Client, disabling security and backup services, and then deploying ransomware.
Sophos observed multiple defence-evasion techniques across the intrusions, including EDR-killing tools that abuse vulnerable drivers, Windows Defender exclusions, attempts to disable real-time protection, more than 200 variations of backup service disruption commands, and log clearing to hinder incident response.
