The Gentlemen Ransomware Emerges with Self-Spreading Worm Engine
A new Go-based ransomware strain, 'The Gentlemen,' is rapidly spreading across networks using a sophisticated worm engine and 21 remote execution techniques, targeting organizations globally.
A potent new ransomware variant, dubbed 'The Gentlemen,' has surfaced, distinguishing itself with a formidable encryption capability coupled with an aggressive self-spreading worm engine. This malware, written in the Go programming language and obfuscated with the Garble tool, first appeared in the wild around mid-2025 and has since evolved into a ransomware-as-a-service (RaaS) operation. Its primary distinguishing feature is its ability to propagate across an entire corporate network from a single infected machine, transforming a localized breach into a widespread disaster.
Researchers from Picus Security have been closely monitoring The Gentlemen ransomware, detailing its operational sequence in a recent report. The malware's attack chain begins with rigorous password validation and privilege escalation, followed by a deliberate phase of defense evasion. Only after disabling security measures does it proceed to encrypt files and initiate its network-wide spreading mechanism. This comprehensive approach aims to cripple an organization's defenses before the encryption even begins.
The impact of The Gentlemen ransomware has been significant, with attacks observed across diverse sectors including education, transportation, healthcare, and financial services. Geographically, its reach extends across North America, South America, Europe, Africa, and Asia, indicating a global threat landscape. The ransomware group has also actively recruited affiliates, including penetration testers and initial access brokers, through platforms like BreachForums, a strategy likely to broaden its attack surface and increase its operational tempo.
Compounding the threat, The Gentlemen ransomware employs double extortion tactics. This involves not only encrypting victim data but also exfiltrating sensitive information, which is then used as leverage to demand ransom payments. This dual-pronged attack strategy significantly increases the pressure on victim organizations to comply with the attackers' demands, making recovery more complex and costly.
The self-propagation feature, activated by a command-line flag named '--spread,' is central to the ransomware's lateral movement capabilities. Once initiated, the infected host becomes a distribution hub. The malware copies its binary to a hidden network share, granting anonymous access, and then leverages legitimate tools like PsExec to scan the network for vulnerable machines, including workstations, servers, and domain controllers.
Before encrypting any files, The Gentlemen ransomware systematically dismantles security defenses. It disables Microsoft Defender, wipes forensic logs, and deletes Volume Shadow Copies using redundant commands. Furthermore, it clears command history and removes backup and recovery tools, making post-attack restoration without paying the ransom exceedingly difficult.
For file encryption, the ransomware utilizes a robust hybrid cryptographic approach, combining Curve25519 elliptic curve cryptography with the XChaCha20 stream cipher. This method generates a unique encryption key for every file, rendering decryption without the attacker's private key virtually impossible. Encrypted files are renamed with a distinct '.umc16h' extension, and a ransom note named 'README-GENTLEMEN.txt' is dropped on infected systems.
Organizations are advised to bolster their defenses by testing security controls against specific attack simulations, maintaining secure offline backups, and closely monitoring for the unique network behaviors and commands associated with this ransomware. Generic ransomware protections may not be sufficient against The Gentlemen's sophisticated propagation and evasion techniques.
The Gentlemen ransomware operation, also tracked by Microsoft as Storm-2697, has significantly expanded its reach, now impacting over 500 victims globally since its emergence in mid-2025. A key differentiator is its custom 'GentleKiller' framework, which includes multiple Bring Your Own Vulnerable Driver (BYOVD) variants designed to disable over 400 security processes from 48 different vendors, alongside integrated third-party EDR killers. The group also employs a Go-based worm encryptor for self-propagation and leverages AI for development of its GLOCKER admin panel, as revealed by a recently leaked internal database.
The Gentlemen ransomware has significantly increased its victim count in 2026, with one source tracking 580 victims across 77 countries by July 7th, a more than six-fold increase compared to the last six months of 2025. The ransomware's operators are offering an unprecedented 90% payout to affiliates, contributing to its rapid growth and making it the second most active RaaS program of the year. New technical details also reveal the use of a custom Go-based backdoor, an EDR killer framework named 'GentleKiller,' and the suspected exploitation of an unspecified zero-day vulnerability.
New analysis from ReliaQuest indicates that The Gentlemen ransomware has surpassed Qilin as the most prolific ransomware threat, accounting for 300 incidents in a recent three-month period. This surge is attributed to the group's aggressive affiliate recruitment and the provision of a well-packaged intrusion kit that simplifies the attack chain for new operators, including a detailed playbook and AI-accelerated development.