The Gentlemen RaaS Evolving Tactics and Backdoors

The Gentlemen is a rapidly emerging Ransomware-as-a-Service (RaaS) group that significantly increased its activity in early 2026, targeting large corporations and critical infrastructure globally. The group utilizes a sophisticated multi-stage attack chain involving custom Go-based backdoors for persistence and remote command execution, followed by the deployment of either Go-based or in-development C-based ransomware variants.

Technically, the group stands out for its use of Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate security products and its ability to automate ransomware distribution via Active Directory Group Policy Objects (GPO). Their reconnaissance efforts are thorough, utilizing tools like SharpADWS to bypass standard LDAP logging and netsh for internal network traffic analysis. The group's rapid climb into the top 10 ransomware actors indicates a high level of operational maturity and a significant threat to global enterprise sectors.

Impacted regions include Brazil, China, Indonesia, Taiwan, and Thailand. Organizations should prioritize securing exposed VPNs/firewalls and monitoring for unauthorized GPO modifications or the installation of known vulnerable drivers.