Storm-2697's Go Ransomware Spreads Itself Across Your Entire Network
The Gentlemen ransomware, deployed by Storm-2697 affiliates, is a Go-based encryptor that combines ephemeral per-file key encryption with aggressive built-in lateral movement to self-propagate across networks without operator intervention.
When the Ransomware Does Its Own Lateral Movement
Most ransomware operations still rely on human operators to handle the messy work of spreading through a network after initial access. Cobalt Strike, living-off-the-land binaries, manual SMB pivots — that tradecraft is well understood and, critically, it takes time. Time that defenders can use. The Gentlemen flips that assumption on its head.
Microsoft Threat Intelligence's analysis of this Storm-2697 affiliate tool describes a Go-based encryptor that ships with its own self-propagation module. The ransomware does not wait for a human to map the environment and push payloads manually. It fires multiple lateral movement techniques simultaneously against each target it identifies. That parallel approach is what makes this particularly uncomfortable to think about from a detection standpoint. Sequential lateral movement generates a recognizable pattern of behavior over time. Simultaneous, multi-technique propagation compresses that window dramatically.
The Encryption Design Matters Too
The per-file ephemeral key design deserves attention on its own. Each file gets encrypted with a key that exists only for that operation, which means there is no single master key to hunt for in memory or extract through a lucky process dump. If your incident response playbook includes any hope of key recovery from a running system, that approach does not apply here. The cryptographic design is deliberately hostile to recovery without paying.
Go as a language choice also continues to be a trend worth tracking. Go binaries are self-contained, cross-compile cleanly, and produce executables that behave consistently across Windows environments without requiring a runtime to be present. From an attacker's perspective the operational overhead is low. From a defender's perspective, Go binaries have historically given static analysis tools more trouble than native C or C++ payloads, though that gap has narrowed.
What Operators Should Actually Do With This
A few practical angles for teams managing Windows environments:
Lateral movement surface area. The fact that this tool uses multiple simultaneous techniques means your network segmentation posture matters more than usual. If workstations can freely reach other workstations over SMB, WMI, or RPC, a single compromised endpoint becomes a propagation origin. Enforcing host-based firewall rules that restrict east-west traffic to only what is operationally necessary is not a new recommendation, but this is a concrete reason to prioritize it.
Detection timing. Self-propagating ransomware shrinks your response window significantly. If your alerting pipeline has multi-hour latency between event generation and analyst review, you are likely looking at a fully encrypted environment before anyone gets paged. This is an argument for automated containment triggers on high-confidence ransomware indicators rather than waiting for human triage.
Storm-2697 affiliate tracking. The attribution to a Storm-2697 affiliate is worth noting for threat modeling purposes. Ransomware-as-a-service ecosystems mean the tooling can spread beyond the original group. The Gentlemen being deployed by affiliates rather than a core team suggests the capability will appear in incidents attributed to actors with varying levels of sophistication.
Go binary detection. If your EDR or file integrity monitoring has specific tuning for Go binaries, now is a good time to review it. Unsigned Go executables appearing in unusual paths, or Go processes spawning network connections to internal hosts, should be high-priority signals.
Microsoft does not appear to have released indicators of compromise in the public summary, so teams should check their Microsoft Defender XDR or Sentinel feeds for any threat intelligence content tied to this campaign. The full technical breakdown, including behavioral signatures and propagation mechanics, is available directly from Microsoft.
Keep reading in Threat Intel
