Ungentlemanly behavior: Insights into a ransomware operation

The Gentlemen ransomware operation, run by GOLD SHERWOOD affiliates, leverages rapid privilege escalation, adaptive defense evasion, and opportunistic initial access—often exploiting VPNs and firewalls—to execute swift, highly effective double-extortion attacks across diverse sectors, with dwell times as short as 24 hours and a sharp rise in victims throughout 2026.