Gentlemen Ransomware: The Double Extortion Threat Targeting Manufacturing and Healthcare

A fast-moving, financially motivated ransomware operation that pairs strong encryption with data theft.

Gentlemen ransomware is a ransomware operation, tracked by Microsoft as Storm-2697, that breaches a corporate network, steals sensitive files, encrypts systems with a Go-based payload, and threatens to publish the stolen data unless a ransom is paid.

The group appeared in mid-2025 and, unusually, arrived already competent. Security researchers at the AhnLab Security Emergency Response Center (ASEC) documented an early wave of attacks; Microsoft's later analysis filled in the operational picture. What both agree on is the level of engineering. This is not a spray-and-pray campaign. Gentlemen operators select targets, get hands on keyboard inside the network, and deploy a payload built to do maximum damage before anyone notices.

A few technical choices tell you who you are dealing with. The encryptor is written in Go, which makes it easy to run across Windows environments, and it requires a password to execute, which stops security analysts from detonating it in a sandbox. It uses modern cryptography (X25519 key exchange paired with the XChaCha20 cipher) and generates a unique key per file, so there is no master decryptor and no shortcut back. Encrypted files carry a ransom note named README-GENTLEMEN.txt in every affected folder.

Before the encryption ever starts, the attackers clear the runway. They disable Windows Defender, use Group Policy Objects to push the infection across networked machines, and lean on Bring Your Own Vulnerable Driver (BYOVD) techniques to get past security software. They stop backup services like Veeam and terminate database engines such as MSSQL and MongoDB so those files can be locked too. Then they delete logs to cover the trail. Microsoft's May 2026 report added a sharper detail: with a --spread switch, the payload turns into a self-propagating worm that tries to push itself to every reachable system, using more than a dozen lateral-movement methods. One foothold can become the whole network in minutes.

Steal the data first, encrypt second, then charge for both.

Double extortion means an attacker exfiltrates a copy of your sensitive data before encrypting your systems, then demands one payment to decrypt the files and a second, implied payment to keep the stolen data from being published on a leak site.

Old-school ransomware had one point of pressure: your files are locked, pay to unlock them. The counter was equally simple. Keep good backups, restore, ignore the demand. Double extortion exists specifically to defeat that counter. By the time your systems lock, the attacker already has a copy of your client records, financial data, contracts, and email sitting on their own infrastructure. Restoring from backup gets your operations back. It does nothing about the leak threat hanging over your head.

The sequence is deliberate. Attackers breach the network and stay quiet. They map where the valuable data lives and quietly copy it out, often over days. Only then do they trigger encryption, drop the note, and start the clock. Gentlemen adds a psychological turn common to these crews: they offer to decrypt one or two sample files for free, to prove they can restore access, while the leak-site countdown pressures you toward paying in full.

Here is the part that catches owners off guard. Paying the ransom does not guarantee the stolen data is deleted. You are trusting a criminal enterprise to honor a promise, with no way to verify it, after they have already lied their way into your network. For a regulated business, a data leak is also a reporting event. A CPA firm answers to the Gramm-Leach-Bliley Act, a medical practice to HIPAA, and the breach itself, not just the downtime, triggers legal obligations. In 35 years around this work, the businesses that came through a ransomware event intact were the ones who treated data theft as the real emergency and downtime as the recoverable inconvenience.

The group hunts the exact sectors that anchor the Houston economy.

Gentlemen ransomware concentrates on manufacturing, healthcare, construction, and financial and insurance firms, which are among the largest employers across the Houston metro, so a local SMB in one of those sectors sits squarely inside the group's confirmed target profile.

Microsoft observed Gentlemen hitting organizations across manufacturing, healthcare, financial services, construction, insurance, energy, education, and government, on multiple continents including North America. Now look at Houston. Manufacturing along the Ship Channel, hospital systems and independent medical practices, construction firms running crews from Katy to The Woodlands, and the insurance and energy companies that fill downtown. The overlap is not a coincidence. These industries hold valuable data and often run lean IT teams, which is exactly the combination that makes double extortion pay.

Size is not the shield owners think it is. A ten-person engineering firm in Sugar Land or a mid-size construction company in Cypress holds client designs, financial records, and contracts that are worth stealing, and it usually lacks a dedicated security team to notice the intrusion. Being part of a supply chain matters too. If you serve a larger manufacturer or an oil and gas operator, your network can be the soft way into theirs, which makes you a target on someone else's behalf. Attackers pick lean businesses precisely because the odds of getting caught mid-intrusion are low.

The Houston-specific point is the sector density. Few metros pack this many manufacturing, healthcare, construction, and energy firms into one region, and Gentlemen has already hit every one of those verticals elsewhere. That concentration means the question for a local owner is not whether the group targets businesses like yours. It is whether your defenses would notice the quiet stage before the files lock.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Defending against a double-extortion group like Gentlemen is not about one product. It is about closing the early stages where the intrusion and data theft happen, and being ready if prevention fails. For a Houston SMB, that means:

• Endpoint detection and response. We watch for the behaviors that precede encryption - disabled defenses, stopped backup services, unusual data movement - so an intrusion gets caught while it is still quiet.
• Network segmentation. We limit lateral movement so one compromised machine cannot become the whole network, which is exactly what the Gentlemen self-spreading payload is built to do.
• Ransomware-resilient backups. Air-gapped and immutable backups the attackers cannot reach or stop, tested on a schedule so recovery is real, not theoretical.
• Incident response planning. A documented plan for both the downtime and the data-leak side, written before you need it, so the decisions are not made in a panic.

CinchOps serves businesses across Houston, Katy, and Sugar Land, with industry experience in manufacturing, construction, and oil and gas - the exact sectors Gentlemen targets most.

Double extortion changes the math on ransomware, and a backup alone no longer covers you. The businesses that stay out of a breach notice are the ones that catch the intrusion early and segment their networks so a single foothold cannot spread. If you want to know whether your defenses would notice the quiet stage of an attack, talk to CinchOps and start with an honest look at where an attacker could get in.