Risk Letters

Threat actor

The Gentlemen

TLP:CLEAR

Facts

  • Also known as: Storm-2697, GOLD SHERWOOD
  • Motivation: Financial
  • Malware and tools: ADFind, AnyDesk, BloodHound, Censys, CertiHound, Chisel-ng, Custom Go Locker (Windows/Linux/NAS), DumpBrowserSecrets, EDRStartupHinder, GFreeze, GLinker, gogo scanner
  • Techniques (MITRE ATT&CK): Audio-Visual Content, Data Encrypted for Impact, Domains, Establish Accounts, Exploit Public-Facing Application, Exploitation for Privilege Escalation, Financial Theft, Invalid Code Signature, Masquerading, Match Legitimate Resource Name or Location, Remote Desktop Software, Remote System Discovery

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.