Executive Summary
The Gentlemen is a rapidly expanding Ransomware-as-a-Service (RaaS) operation that emerged in mid-2025 and has claimed over 320 victims, predominantly in early 2026. The group utilizes a sophisticated locker portfolio written in Go (for Windows/Linux) and C (for ESXi), enabling high-impact attacks across diverse corporate infrastructures. Evidence suggests affiliates are leveraging a mature toolchain, including SystemBC for covert SOCKS5 tunneling and Cobalt Strike for command-and-control.
Technical analysis of a 2026 intrusion reveals a highly automated attack chain starting from Domain Controller compromise. The actors utilize built-in ransomware arguments to automate lateral movement via PsExec, WMI, and Group Policy Objects (GPO). The campaign is characterized by aggressive defense evasion, including the systematic disabling of Windows Defender and the use of AnyDesk for persistent remote access. The broad infection profile of associated SystemBC infrastructure, with over 1,570 victims, indicates a concerted effort to target organizational rather than consumer environments.
This threat poses a critical risk due to its enterprise-scale deployment capabilities and multi-extortion tactics. The use of P2P Tox communications and a public X (Twitter) presence for victim shaming increases pressure on organizations. The ability to target ESXi hosts specifically highlights the risk to virtualized data centers and cloud service providers.