Ransomware groups are strategic in who they target and the methods they use, but many organizations are still left wondering why their protective measures were insufficient. Microsoft Threat Intelligence's technical analysis of The Gentlemen, published on May 28, 2026, addresses The Gentlemen’s tactics and strategies. Gentlemen’s malware itself is not especially sophisticated by nation-state standards, but it is unusually well engineered for one narrow job, landing on a single device and then reaching every other device on the same network before anyone catches on. Concerningly, healthcare is already on the list of sectors Microsoft has observed it hitting.

 

Where it came from

Microsoft tracks the operators behind it as Storm-2697, a financially motivated group running the platform while independent affiliates carry out the attacks themselves. It started as a closed operation around mid-2025, then opened up as Ransomware-as-a-Service that September. More recently, Storm-2697 struck a formal recruitment deal with BreachForums to bring in penetration testers and initial access brokers as affiliates, a move that widens who gets access to these tools considerably.

The malware is written in Go, a programming language that makes it easier to run the same code across different systems without much modification, and it is obfuscated with a tool called Garble, which scrambles the code's structure specifically to slow down security researchers trying to analyze it. It targets Windows environments using double extortion, meaning the malware both encrypts a victim's files and steals a copy of that data before locking it, giving attackers two separate ways to pressure a victim into paying rather than one. Microsoft has already observed it across education, transportation, healthcare, and financial services, spanning North America, South America, Europe, Africa, and Asia.

Read more: What is ransomware?

 

The part that sets it apart

Ordinary ransomware still needs a human to manually move between systems after that first foothold. The Gentlemen skip that step entirely. Built into it is a self-propagation module, meaning it can automatically copy and spread itself without any further input from the attacker, which turns one infected device into its own distribution hub, working to reach every other reachable machine on the network without anyone lifting a finger.

According to Microsoft's analysis, deploying it with propagation switched on sets off a sequence that runs entirely on its own. The malware copies itself onto the network, maps every other device it can reach, and then tries 21 different lateral movement techniques against each one at the same time. Lateral movement is the term for how an attacker moves from one compromised device to another on the same network, and these particular techniques use standard Windows administration tools, the kind most IT teams already run in their environment for everyday tasks like remote troubleshooting or software deployment.

Every method runs regardless of whether the others succeed or fail, which is the detail worth sitting with. Most defenders manage to block some lateral movement techniques, and conventional ransomware slows down when it hits one of those blocks. This one does not wait to find out what worked. A single unblocked path anywhere in an organization's defenses is enough, even if the other 20 attempts fail outright.

 

Before the encryption even starts

Microsoft's analysis found that nothing gets touched until a sequence runs first, designed to make sure recovery is not an option. Microsoft Defender's real-time monitoring gets disabled, and the malware adds itself to the exclusion list; the list of files and processes Defender is told to ignore, so it can operate without triggering an alert. Every Volume Shadow Copy gets wiped, a Windows feature that automatically saves earlier versions of files and is often the quiet backup option many organizations lean on without realizing it is their only one. System, Application, and Security event logs get cleared, erasing the records Windows normally keeps of what happened on a device, and prefetch files, Defender diagnostic logs, RDP logs, and PowerShell command history disappear from every user profile, stripping out the trail investigators would otherwise use to reconstruct the attack.

From there, it goes after processes directly, targeting databases, backup software, EDR agents (endpoint detection and response tools, the software meant to catch exactly this kind of activity), SAP, Office applications, email clients, and remote access tools, shutting down the associated Windows services along the way. Microsoft's write-up calls out something specific here, naming Veeam backup services and Acronis agents by name alongside several other enterprise backup products on the termination list.

Microsoft's analysis found that the encryption method itself is built for speed rather than sophistication. Smaller files are fully encrypted, meaning every byte is scrambled, while larger files only need small sections encrypted at scattered points throughout the file, a shortcut that still makes the file completely unreadable but lets the malware work through an entire network's worth of data far faster than fully encrypting everything would allow.

Once encryption finishes, a ransom note lands in every touched directory, and the desktop wallpaper switches to a branded image. Configured a certain way, it will also overwrite unallocated disk space, the portions of a drive not currently holding active files but which may still contain recoverable fragments of deleted or previous data, with random data, closing off forensic recovery of anything that existed before the attack.

Read also: How to develop a backup and recovery plan

 

 

Why does healthcare specifically bear the brunt

Hospitals run unusually interconnected networks by design. Clinical workstations, EHR servers, medical devices, billing systems, and administrative machines frequently share the same underlying infrastructure, and a strain engineered to reach every device on a network at once does not stay confined to one department in that kind of environment. It moves through everything clinical care actually runs on, simultaneously.

Microsoft's analysis also flags that the malware actively hunts for mapped drives, network shares, and cluster shared volumes once it has traversed onto the network. In a hospital, that shared storage typically holds imaging archives, clinical records, and shared workflow files, exactly the resources this share-traversal capability was built to find.

The Verizon 2026 Data Breach Investigations Report put ransomware in 48% of confirmed breaches this year, the highest share on record. Paubox's 2026 Healthcare Email Security Report tracked 170 email-related healthcare breaches in 2025, affecting more than 2.5 million individuals, with phishing as the dominant way in across that dataset, which is the exact foothold this malware's propagation module is waiting for.

 

Where the first foothold actually comes from

None of the self-propagation matters until the malware lands on one device, and that first access most commonly comes through phishing, compromised credentials, or an exploited public-facing application. Paubox's 2025 Healthcare Email Security Report found that only 5% of known phishing attempts in healthcare get reported by employees to security teams, so the email that delivers the initial credential or payload goes unnoticed at the human level almost every time.

Pre-delivery filtering catches that message before staff ever see it, addressing the entry point before propagation, backup deletion, log clearing, or encryption becomes relevant at all. Paubox's 2026 Healthcare Email Security Report tracked a 47% rise in attacks evading native email defenses in 2025, confirming that default filtering in Microsoft 365 and Google Workspace is not holding up against current phishing campaigns. Paubox Inbound Email Security uses AI to analyze sender behavior, message intent, and contextual signals, catching what signature-based systems miss before it reaches an inbox.

Beyond email, Microsoft's own guidance for defending against this malware includes turning on tamper protection for Defender so it cannot be disabled remotely, enabling controlled folder access to stop unauthorized applications from touching protected files, and running endpoint detection in block mode so Defender for Endpoint can act even when the primary antivirus sits passive.

Learn more: Paubox Inbound Email Security

 

FAQs

What makes The Gentlemen different from other ransomware groups?

Most ransomware needs a human to manually move between systems after initial access. This one automates it, firing 21 lateral movement techniques at every reachable host at once, so a single unblocked path is enough for it to spread even when most standard defenses hold.

 

Why does it specifically go after backup systems?

Before encrypting anything, it shuts down services tied to Veeam, Acronis, and other enterprise backup products, removing the recovery option that organizations without tested offline backups depend on and cutting off the practical alternative to paying.

 

Can encrypted files be recovered without paying?

Every file is locked with its own unique key, and without the matching key held by the attacker, decryption is not possible through any known method. Recovery depends entirely on paying or restoring from backups predating the infection.

 

Why is healthcare especially exposed to self-propagating ransomware?

Healthcare networks are highly interconnected by design, with clinical workstations, EHR servers, and medical devices often sharing infrastructure. A strain that spreads automatically to every reachable host moves through everything clinical care depends on, all at once.

 

What single defense matters most against this specific malware?

Stopping the initial access that gives it a first foothold, since every other capability depends on that first device being compromised. Phishing remains the most consistently documented entry point, and filtering it out before staff sees it addresses the whole chain before it starts.