The Gentlemen ransomware now uses SystemBC for bot-powered attacks

Threat actors associated with The Gentlemen ransomware‑as‑a‑service (RaaS) operation have been observed attempting to deploy a known proxy malware called SystemBC. According to new research published by Check Point, the command-and-control (C2 or C&C) server linked to SystemBC has led to the discovery of a botnet of more than 1,570 victims. "SystemBC establishes SOCKS5 network tunnels within the victim’s environment and connects to its C&C server using a custom RC4‑encrypted protocol," Check Point said. "It can also download and execute additional malware, with payloads either written to disk or injected directly into memory." Since its emergence in July 2025, The Gentlemen has quickly established itself as one of the most prolific ransomware groups, claiming more than 320 victims on its data leak site. Operating under a classic double-extortion model, the group is versatile as it's sophisticated, exhibiting capabilities to target Windows, Linux, NAS, and BSD systems with a Go-based locker as well as employing legitimate drivers and custom malicious tools to subvert defenses. Exactly how the threat actors obtain initial access is unclear, although evidence suggests that internet-facing services or compromised credentials are being abused to establish an initial foothold, followed by engaging in discovery, lateral movement, payload staging (i.e., Cobalt Strike, SystemBC, and the encryptor), defense evasion, and ransomware deployment. A notable aspect of the attacks is the abuse of Group Policy Objects (GPOs) to facilitate domain-wide compromise. "By tailoring their tactics against specific security vendors, The Gentlemen have demonstrated an acute awareness of their targets' environments and a willingness to engage in in-depth reconnaissance and tool modification throughout the course of their operation," security vendor Trend Micro noted in an analysis of the group's tradecraft in September 2025. The latest findings from Check Point show that an affiliate of The Gentlemen RaaS deployed SystemBC on a compromised host, with the C2 server linked to the proxy malware commandeering hundreds of victims across the globe, including the U.S., the U.K., Germany, Australia, and Romania. While SystemBC has been used in ransomware operations as far back as 2020, the exact nature of the connection between the malware and The Gentlemen e-crime scheme remains unclear, such as whether it's part of the attack playbook or if it's something deployed by a specific affiliate for data exfiltration and remote access. "During lateral movement, the ransomware makes an attempt to blind Windows Defender on each reachable remote host by pushing a PowerShell script that disables real-time monitoring, adds broad exclusions for the drive, staging share, and its own process, shuts down the firewall, re-enables SMB1, and loosens LSA anonymous access controls, all before deploying and executing the ransomware binary on that host," Check Point said. The ESXi variant incorporates fewer functionalities than the Windows variant, but is equipped to shut down virtual machines to enhance the effectiveness of the attack, adds persistence via crontab, and inhibits recovery before the ransomware binary is deployed. "Most ransomware groups make noise when they launch and then disappear. The Gentlemen are different," Eli Smadja, group manager at Check Point Research, said in a statement shared with The Hacker News. "They've cracked the affiliate recruitment problem by offering a better deal than anyone else in the criminal ecosystem. When we got inside one of their operator's servers, we found over 1,570 compromised corporate networks that hadn't even made the news yet. The real scale of this operation is significantly larger than what's publicly known, and it's still growing." The findings come as Rapid7 highlighted the inner workings of another relatively new ransomware family called Kyber that surfaced in September 2025, targeting Windows and VMware ESXi infrastructures using encryptors developed in Rust and C++, respectively. "The ESXi variant is specifically built for VMware environments, with capabilities for datastore encryption, optional virtual machine termination, and defacement of management interfaces," the cybersecurity company said. "The Windows variant, written in Rust, includes a self-described 'experimental' feature for targeting Hyper-V." "Kyber ransomware isn't a masterpiece of complex code, but it is highly effective at causing destruction. It reflects a shift toward specialization over sophistication." According to data compiled by ZeroFox, at least 2,059 separate ransomware and digital extortion (R&DE) incidents have been observed in Q1 2026, with March accounting for no less than 747 incidents. The most active groups during the time period were Qilin (338), Akira (197), The Gentlemen (192), INC Ransom, and Cl0p. "Notably, North America-based victims accounted for approximately 20 percent of The Gentlemen's attacks in Q3 2025, 2% in Q4 2025, and 13% in Q1 2026," ZeroFox said. "This largely goes against typical regional targeting trends by other R&DE collectives, at least 50 percent of whose victims are North America-based." The Shifting Velocity of Ransomware Attacks Cybersecurity company Halcyon, in its 2025 Ransomware Evolution Report, revealed that the threat continues to mature into something more disciplined and a business-driven criminal enterprise, even as ransomware attacks targeting the automotive industry more than doubled in 2025, taking up 44% of all cyber incidents across the sector. Other significant trends include attempts to impair security Endpoint Detection and Response (EDR) tools, use of the Bring Your Own Vulnerable Driver (BYOVD) attack technique to escalate privileges and disable security solutions, blurring of nation-state and criminal ransomware campaigns, and increased targeting of small and mid-sized organizations and operational technology (OT) environments. "Ransomware continued to grow as a durable, industrialized ecosystem built on specialization, shared infrastructure, and rapid regeneration rather than any single brand," it said. "Law enforcement pressure and infrastructure seizures disrupted major operations, driving fragmentation, rebranding, and intensified competition across a more fluid landscape." Ransomware operations are increasingly fast-moving, with dwell times collapsing from days to hours. About 69% of observed attack attempts have been found to be deliberately staged during nights and weekends to outpace defender response. For instance, attacks involving Akira ransomware have demonstrated an unusual swiftness, rapidly escalating from initial foothold to full encryption within an hour in some cases without detection, highlighting a well-oiled attack engine designed to maximize impact. "Akira's combination of rapid compromise capabilities, disciplined operational tempo, and investment in reliable decryption infrastructure sets it apart from many ransomware operators," Halcyon said. "Defenders should treat Akira not as an opportunistic threat, but as a capable, persistent adversary that will exploit every available weakness to reach its objective."

A SystemBC proxy malware botnet of more than 1,570 hosts, believed to be corporate victims, has been discovered following an investigation into a Gentlemen ransomware attack carried out by a gang affiliate. The Gentlemen ransomware-as-a-service (RaaS) operation emerged around mid-2025 and provides a Go-based locker that can encrypt Windows, Linux, NAS, and BSD systems, and a C-based locker for ESXi hypervisors. Last December, it compromised one of Romania’s largest energy providers, the Oltenia Energy Complex. Earlier this month, The Adaptavist Group disclosed a breach that Gentlemen ransomware listed on its data leak site. Although the RaaS operation has publicly claimed around 320 victims, most of the attacks occurring this year, Check Point researchers discovered that the Gentlemen ransomware affiliates are expanding their attack toolkit and infrastructure. During an incident response engagement, the researchers found that an affiliate for the ransomware operation tried to deploy the proxy malware for covert payload delivery. “Check Point Research observed victim telemetry from the relevant SystemBC command‑and‑control server, revealing a botnet of over 1,570 victims, with the infection profile strongly suggesting a focus on corporate and organizational environments rather than opportunistic consumer targeting,” the researchers say in a report today. SystemBC has been around since at least 2019 and is used for SOCKS5 tunneling. Due to its capability to deliver malicious payloads, it was quickly adopted and also to send malicious payloads. It capability to introduce payloads onto infected systems was quickly adopted by ransomware gangs. Despite a law enforcement operation that affected it in 2024, the botnet remains active, and last year Black Lotus Labs reported that it was infecting 1,500 commercial virtual private servers (VPS) every day to funnel malicious traffic. According to Check Point, most of the victims linked to Gentlemen’s deployment of SystemBC are located in the United States, the United Kingdom, Germany, Australia, and Romania. "The specific Command and Control server that was used for the communication had infected a large number of victims across the globe. It is likely that the majority of those victims are companies and organizations, given that SystemBC is typically deployed as part of human‑operated intrusion workflows rather than massive targeting," Check Point says. The researchers are unsure how SystemBC fits into Gentlemen ransomware's ecosystem and could not determine if the malware was used by multiple affiliates. Infection chain and encryption scheme Although Check Point could not determine the initial access vector in the observed attacks, the researchers say that the Gentlemen threat actor operated from a Domain Controller with Domain Admin privileges. From there, the attacker checked which credentials worked and conducted reconnaissance before deploying Cobalt Strike payloads to remote systems via RPC. Lateral movement was supported by credential harvesting using Mimikatz and remote execution. The attackers staged the ransomware from an internal server and leveraged built-in propagation and Group Policy (GPO) to trigger near-simultaneous execution of the encryptor across domain-joined systems. According to the researchers, the malware uses a hybrid scheme based on X25519 (Diffie–Hellman) and XChaCha20, with a random ephemeral key pair generated for each file. Files under 1 MB are fully encrypted, while with larger files only chunks of data of about 9%, 3%, or 1% were encrypted. Before encryption, Gentlemen ransomware terminates databases, backup software, and virtualization processes, and deletes Shadow copies and logs. The ESXi variant also shuts down VMs to ensure the disks can be encrypted. The Gentlemen ransomware doesn’t make headlines often but Check Point warns that the RaaS is quickly growing, advertising to recruit new ransomware affiliates via underground forums. The researchers believe that using SystemBC with Cobalt Strike and the botnet of 1,570 hosts may indicate that the Gentlemen ransomware gang is now operating at a higher level, "actively integrating into a broader toolchain of mature, post‑exploitation frameworks and proxy infrastructure." Apart from indicators of compromise (IoCs) collected from the investigated incident, Check Point also provides signature-based detection in the form of a YARA rule to help defenders protect against such attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy April 20, 2026 Key Points The Gentlemen ransomware‑as‑a‑service (RaaS) program is rapidly gaining popularity, attracting numerous affiliates and publicly claiming over 320 victims, with the majority of attacks (240) occurring in the first months of 2026. The service provides a broad locker portfolio implemented in Go for Windows, Linux, NAS, and BSD, plus an additional locker written in C for ESXi, enabling coverage of the multiple platforms commonly found in corporate environments. During an incident response engagement, an affiliate associated with The Gentlemen attempted to deploy SystemBC, a proxy malware frequently leveraged in human‑operated ransomware operations for covert tunneling and payload delivery. Check Point Research observed victim telemetry from the relevant SystemBC command‑and‑control server, revealing a botnet of over 1,570 victims, with the infection profile strongly suggesting a focus on corporate and organizational environments rather than opportunistic consumer targeting. The Gentlemen RaaS The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple underground forums, promoting their ransomware platform and inviting penetration testers (and other technically skilled actors) to join as affiliates. The RaaS provides affiliates with multi‑OS lockers for Windows, Linux, NAS, BSD implemented in Go, and an additional locker for ESXi implemented in C. The group also grants verified partners access to EDR‑killing tools and its own multi‑chain pivot infrastructure (server and client components). The group maintains an onion site where it publishes data stolen from victims who refuse to pay. Negotiations, however, are not conducted through this leak portal but via the individual affiliate’s Tox ID. Tox is a free, decentralized, peer‑to‑peer (P2P) instant messaging protocol that provides end‑to‑end encrypted voice, video, and text communication. The group also appears to maintain a Twitter/X account, which is referenced in the ransomware note. Through this account, the operators publicly post about victims, likely to increase pressure on them to pay. To date, the group has publicly claimed a little over 320 victims, with the majority of infections occurring in 2026. This growth in activity suggests that The Gentlemen RaaS program has managed to attract a significant number of affiliates over the last few months. SystemBC Infections During an incident response case, an affiliate of The Gentlemen Ransomware‑as‑a‑Service (RaaS) deployed SystemBC, a proxy malware, on the compromised host. SystemBC establishes SOCKS5 network tunnels within the victim’s environment and connects to its C&C server using a custom RC4‑encrypted protocol. It can also download and execute additional malware, with payloads either written to disk or injected directly into memory. The specific Command and Control server that was used for the communication had infected a large number of victims across the globe. It is likely that the majority of those victims are companies and organizations, given that SystemBC is typically deployed as part of human‑operated intrusion workflows rather than massive targeting. There are over 1,570 victims, with the majority located in the United States, followed by the United Kingdom and Germany. Whether SystemBC is directly integrated into The Gentlemen ransomware ecosystem or is simply a tool leveraged by this particular affiliate for exfiltration and remote access remains unclear. At this time, Check Point Research has no evidence to determine the exact nature of this relationship. DFIR Report – Timeline Initial Access and Establishment of Domain Control The precise initial access vector could not be conclusively determined. The earliest stage of adversary activity that can be established with confidence is the attacker’s presence on a Domain Controller with Domain Admin–level privileges. From that position, the attacker appears to have performed systematic credential validation and host accessibility testing across the environment, as reflected in an initial pattern of failed network logons followed by successful authentications originating from the Domain Controller. This sequence is consistent with a controlled effort to verify privileged access and identify viable systems before expanding operations more broadly. Remote Execution and Early Discovery Using this privileged position, the attacker deployed Cobalt Strike payloads to remote systems by writing executables to administrative shares such as \\\\[REDACTED_HOSTNAME]\\ADMIN$\\ .exe and executing them via RPC. The first observed deployment occurred on an internal endpoint, after which similar activity appeared across additional hosts. Early post-compromise actions included reconnaissance commands such as cmd.exe /C systeminfo, cmd.exe /C whoami, and enumeration commands like cmd.exe /C dir c:\\users. The attacker also accessed internal documentation via cmd.exe /C type \\\\[REDACTED_HOSTNAME]\\d$\\...\\公司主機紀錄.txt, indicating use of environment-specific knowledge in addition to automated discovery. Expansion to other systems followed quickly, with repeated execution artifacts such as regsvr32.exe across multiple hosts confirming centrally driven activity. Command-and-Control and Payload Staging As execution expanded, the attacker attempted to establish additional command-and-control capabilities. On one compromised host, it staged the tool socks.exe – identified as a variant of SystemBC – was executed and attempted to communicate with 45.86.230[.]112, followed by validation using cmd.exe /C tasklist | findstr /i socks. This tool is commonly used to create SOCKS-based proxy channels for covert communication and internal pivoting. In this instance, however, the activity was blocked by endpoint protection. Shortly thereafter, a remotely executed payload ( .exe) spawned c:\\windows\\system32\\rundll32.exe, which established outbound communication to 91.107.247[.]163 Cobalt Strike C&C over ports 443 and later 80, indicating successful external command-and-control connectivity through alternative infrastructure. At the same stage, PowerShell was executed from a scheduled task context using: This command downloaded grand.exe (the ransomware encryptor) from an internal staging server (DC) and executed it as c:\\programdata\\r.exe. The arguments --password VvO8EtUh and --spread [REDACTED_DOMAIN]\\[REDACTED_USER]:[REDACTED_PASSWORD] indicate both controlled execution and built-in propagation capability, marking a transition from initial access to coordinated malware deployment. Defense Evasion, Propagation, and Persistence Following execution of the staged payload, the attacker attempted to weaken host defenses using: This disabled Windows Defender real-time monitoring. The same payload, identified by a consistent hash, then appeared across numerous systems under different filenames, including c:\\programdata\\r.exe, c:\\programdata\\g.exe, and c:\\programdata\\o.exe. This demonstrates rapid internal propagation via a shared malware component, supported by both domain-level access and the built-in spreading mechanism described earlier. In parallel, the attacker performed environmental checks using commands such as: cmd.exe /C wmic product where Name like '%kaspe%' get Name, IdentifyingNumber Later, repeatedly executed across multiple hosts: cmd.exe /C gpupdate /force These attempts suggest the threat actor tried to influence or validate policy state during propagation. Remote Desktop was then enabled through commands such as: cmd.exe /C reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0 /f cmd.exe /C netsh advfirewall firewall set rule group="remote desktop" new enable=Yes Later, the attacker installed and configured AnyDesk using: This established a persistent remote access channel with a predefined password (Camry@12345), adding a secondary access mechanism after the SystemBC attempt was blocked. Credential Access and Continued Discovery Compromised hosts were also used for credential harvesting. Mimikatz output recovered from memory on one of the compromised endpoints showed access to credential material, including domain accounts and stored credentials from Credential Manager. This confirms that credential access occurred alongside lateral movement and malware deployment. At the same time, the attacker continued discovery operations using commands such as: cmd.exe /C query session cmd.exe /C nltest /domain_trusts cmd.exe /C nltest /dclist cmd.exe /C net group "Domain Admins" /domain cmd.exe /C net group "Enterprise Admins" /domain These commands indicate enumeration of active sessions, domain trust relationships, domain controllers, and privileged groups, reflecting a shift toward understanding and potentially controlling the broader domain structure. Consolidated View of the Intrusion Taken together, the attack progressed from suspected perimeter access to domain-level control, followed by credential validation, remote payload execution via ADMIN$ shares, and rapid expansion across endpoints. This was accompanied by attempted and successful command-and-control establishment using infrastructure such as 45.86.230[.]112 and 91.107.247[.]163, staged malware delivery from the internal DC, and widespread propagation of a shared payload under multiple filenames. Defensive measures were actively suppressed, and multiple persistence and exfiltration mechanisms were introduced, including RDP and AnyDesk. The failed deployment of SystemBC and the subsequent reliance on alternative channels demonstrate that the attacker adapted their approach when blocked. Overall, the activity reflects coordinated, centrally controlled execution with layered access mechanisms, resulting in broad, durable control over the environment. Impact The intrusion culminated in the deployment of The Gentlemen RaaS payload by an affiliate, using Group Policy as the distribution mechanism. A GPO‑based deployment was configured so that the ransomware binary was executed on domain‑joined systems during policy refresh, resulting in a rapid, near‑simultaneous encryption event across the environment. The Gentlemen GO Ransomware The Gentlemen ransomware is developed in the Go programming language. It appears to be under active development, with new features and capabilities being continuously added over time. Command Line Arguments The Gentlemen ransomware exposes a wide range of command‑line options that provide numerous features to its operators. While most flags are optional, the only mandatory argument required to start the encryption process is --password, which appears to be unique per build/infection. Usage: %s --password PASS [--path DIR1,DIR2,...] [--T MIN] [--silent] [--wipe] [--keep] [--full/system/shares] [--gpo/spread] [--fast/superfast/ultrafast] Main Flags --password PASS Access password (required) --path DIRS Comma-separated list of target directories/disks (optional) --T MIN Delay before start, in minutes (optional) Mode Flags (cant be mixed) --system Run as SYSTEM: encrypt only local drives (optional) --shares Encrypt only mapped network drives and available UNC shares in session context (optional) --full Two-phase: --system + --shares. Best practice. (optional) Additional Flags --spread CREDS Lateral movement: "domain/user:pass" with creds, or "" for current session --gpo Deploy via Group Policy to all domain computers (run on DC) --silent Silent mode: do NOT rename and modify time of files after encryption, no wallpaper(optional) --keep Do not selfdelete after encryption (optional) --wipe Wipe free space after encryption (optional) Speed Flags (cant be mixed) --fast 9 percent crypt. (optional) --superfast 3 percent crypt. (optional) --ultrafast 1 percent crypt. (optional) Example 1: --password QWERTY --path "C:\\,D:\\,\\\\nas\\share" --T 15 --silent Example 2: --password QWERTY --system --fast Example 3: --password QWERTY --shares --T 10 Example 4: --password QWERTY --full --ultrafast Example 5: --password QWERTY --full --spread "domain\\admin:P@ss" # With credentials Example 6: --password QWERTY --T 10 --keep --spread "" # Current session Example 7: --password QWERTY --gpo --full --fast [+] The minimum required command‑line for The Gentlemen ransomware execution is: $process_name --password $pass The password is plaintext hardcoded in the binary validates it with the password provided in the required argument. Processes & Services Termination To terminate running processes, the malware repeatedly executes the following command in a loop for each targeted process: taskkill /IM .exe /F For service termination, the ransomware relies on two distinct commands: sc config start=disabled, sends a stop signal to the service right now, killing it immediately if it’s currently running. sc stop , sends a stop signal to the service right now, killing it immediately if it’s currently running. Persistence During execution, the ransomware attempts to establish persistence using multiple mechanisms. It first attempts to create a scheduled task, initially without validating the current process privileges: The second local persistence method relies on a Run registry key. As with scheduled tasks, the malware attempts to configure this both for the system (HKLM) and for the current user (HKCU): When the --spread argument is enabled, the ransomware also attempts to maintain remote persistence on each reachable host. For each target, it sets up two persistence mechanisms: Scheduled tasks–based persistence Service–based persistence Both mechanisms attempt to execute the ransomware from different locations on the remote machine or over a share. *Full command lines for the --spread argument are provided further below. Antivirus Evasion The ransomware executes three PowerShell commands to disable Microsoft Defender protection and exclude both itself and the entire C:\\ drive from scanning and monitoring: powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true -Force, disables Defender’s real-time protection entirely, the background scanning that monitors files, downloads, and processes as they’re accessed. With this off, malware can run without being intercepted. powershell -Command Add-MpPreference -ExclusionProcess -Force, adds a specific executable to Defender’s process exclusion list. Defender will completely ignore any file activity triggered by that process, even if it’s doing something malicious. powershell -Command Add-MpPreference -ExclusionPath C:\\ -Force, adds the entire C: drive to Defender’s path exclusion list. This tells Defender to skip scanning anything on the drive, every file, folder, and executable. During lateral movement, the ransomware makes an attempt to blind Windows Defender on each reachable remote host by pushing a PowerShell script that disables real-time monitoring, adds broad exclusions for the drive, staging share, and its own process, shuts down the firewall, re-enables SMB1, and loosens LSA anonymous access controls, all before deploying and executing the ransomware binary on that host. The ransomware tries to disable the firewall to allow unrestricted outbound and inbound traffic. This enables lateral movement tools (PsExec, WMI, SMB) to reach remote hosts without firewall rules blocking them, and allows exfiltration channels to operate freely. Bellow the executed commands deactivating the firewall: The --spread argument is disabled by default and is assigned the value "DISABLED". The lateral movement phase is only activated when the operator explicitly supplies --spread "domain\\user:password", providing credentials harvested from the environment. These credentials are then reused across all lateral movement operations: PsExec receives them via the -u and -p parameters, WMI uses them for remote authentication, and remote scheduled task and service creation, authenticating with them against each target host. Once --spread is enabled, the ransomware enumerates all domain computers via Active Directory, pings each discovered host to confirm reachability, and, for every host that responds, executes the full lateral movement sequence: copying the binary, pushing the Defender‑disabling script, and deploying it through six parallel execution channels across PsExec, WMI, scheduled tasks, and services. The --gpo flag enables the most powerful and far-reaching deployment method in the entire binary, reserved specifically for operators who have already compromised a Domain Controller. It is designed to weaponize Active Directory’s own Group Policy infrastructure to detonate the ransomware simultaneously on every computer in the domain. When --gpo is enabled, the following PowerShell script is executed: In order to enumerate network drives the ransomware executes a sequence of Windows commands that force-enable network discovery and related services, making the machine visible and reachable on the local network. Then loads dynamically mpr.dll and by using the Windows API functions enumerates the networks shares: WNetOpenEnumW WNetEnumResourceW WNetCloseEnum Directories, Filenames and Extensions Exclusion As with many other ransomware families, this one also excludes specific directories, filenames, and file extensions from encryption, ensuring that the system remains at least partially usable after the attack. During execution, the ransomware attempts to delete shadow copies, which are a primary mechanism for recovering encrypted files: vssadmin delete shadows /all /quiet wmic shadowcopy delete rd /s /q C:\\$Recycle.Bin In addition to shadow copies, the ransomware also deletes various log files. These logs typically contain authentication events, process and service creation events, and traces of lateral movement. The destruction of these artifacts clearly aims to remove forensic evidence of the intrusion and hinder post-incident investigation. wevtutil cl System wevtutil cl Application wevtutil cl Security del /f /q C:\\Windows\\Prefetch\\*.* del /f /q C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.* del /f /q %SystemRoot%\\System32\\LogFiles\\RDP*\\*.* Free Space Wiping When the threat actor executes the ransomware with the --wipe argument, the malware additionally attempts to wipe free disk space. It creates a file named wipefile.tmp on each targeted drive and writes 64 MB chunks of data to it until all free space is exhausted. This process overwrites previously deleted file content that could otherwise be recovered using forensic tools. Background Image Change If the --silent argument is not specified, the ransomware replaces the desktop background with an embedded image. The image resource is written to %TEMP%\\gentlemen.bmp, and the malware then calls SystemParametersInfoW to set it as the desktop wallpaper. File Encryption Before encryption begins, the ransomware checks whether the file size exceeds 0x100000 (1,048,576 bytes, or 1 MB). Files of 1 MB or smaller are routed to the small file function, while files larger than 1 MB are routed to the large file function. Regardless of size, the key derivation process is identical for both paths. The ransomware generates a random 32-byte ephemeral private key. Using X25519 (the Diffie–Hellman primitive over Curve25519), it derives two values: first, the ephemeral public key by multiplying the private key with the curve basepoint, and second, a shared secret by combining the ephemeral private key with the attacker’s public key. The ephemeral public key is not secret and will later be stored in the file, while the shared secret remains only in memory. Key material for encryption is then constructed directly from these values. The ephemeral public key is used as the 32-byte symmetric key, while the first 24 bytes of the shared secret (derived with the attacker’s public key) are used as the nonce. For small files (less than 1MB) the contents are encrypted using XChaCha20, a stream cipher, which XORs the plaintext with a keystream to produce ciphertext of identical length. The original file is overwritten in place with this ciphertext. For large files larger than 1 MB, the encryption process changes depending on optional speed mode arguments that control how much of the file is actually encrypted. Instead of processing the entire file, the algorithm only encrypts a small portion of it. In fast mode about 9 percent of the file is encrypted. In superfast mode about 3 percent is encrypted. In ultrafast mode only about 1 percent of the file is affected. The encrypted regions are selected across the file and processed in chunks of about 64 KB. Each chunk is read, encrypted using XChaCha20, and written back to the same position in the file. After encryption, the function appends a footer to the file containing the string --eph--, followed by the base64-encoded ephemeral public key and a newline. This is followed by a marker section --marker--GENTLEMEN\\n and a final GENTLEMEN sentinel. The stored ephemeral public key allows the attacker, who possesses the corresponding private key, to recompute the shared secret and reconstruct the nonce, enabling decryption of the file. If any of the speed-increasing arguments (fast, superfast, or ultrafast) were specified during large file encryption, the selected argument is also appended to the end of the file. The attacker’s decryptor obtains the base64 value from the header (--eph-- field), decodes it to get the ephemeral public key, and uses it directly as the ChaCha20 key. It then recomputes sharedSecret = X25519(attacker_privKey, ephemeralPubKey) using the attacker’s own private key, and uses the first 24 bytes of sharedSecret2 as the ChaCha20 nonce. With the key and nonce recovered, it decrypts the encrypted files. The Gentlemen ESXi Variant Latest ELF variant of The Gentlemen ransomware remains undetected by the majority of the Antivirus systems as seems in VirusTotal. The incapability to trigger and execute the malicious code due to the --password requirement possibly affects the detection results, even though for Windows samples this does not appear to be an issue. Command Line Arguments The majority of the arguments functionalities are observed as well in the ELF variant of The Gentlemen ransomware. Usage: %s --password PASS --path DIR [--ignore VMS] [--T MIN] [--fast] [--superfast] [--ultrafast] Main Flags --password PASS Access password (required) --path DIR Target directories, comma-separated (required) Example: --path /vmfs/ Example2: --path "/vmfs/,/datastore/,/mnt/storage" --ignore VMS VM display names to ignore, comma-separated (optional) Example: --ignore DomainController Example2: --ignore "DomainController,Backup Server" --T, --timer MIN Delay before start in minutes (optional) Example: --T 15 Example2: --timer 15 Speed Flags (can't be mixed) --fast Lock 9 percent of file (optional) --superfast Lock 3 percent of file (optional) --ultrafast Lock 1 percent of file (optional) [+] The ESXi variant exposes fewer functionalities than the Windows variant, as many features present in the Windows version are not required on ESXi systems. The minimum required command‑line for Linux Gentlemen ransomware execution is: $process_name --password $pass --path $path(s) VM & Processes Termination Ransomware operators shut down virtual machines on an ESXi host to make their attack more effective and efficient. By powering off the VMs, they release locks on virtual disk files, allowing those files to be encrypted more reliably and with less risk of interference or corruption. This also disables any security tools running inside the guest systems, reducing the chance of detection or response. The locker performs a controlled shutdown of all virtual machines on a VMware ESXi host. It first lists all registered VMs and iterates through them to issue a graceful power-off command (optionally skipping specified VMs). After a short wait to allow clean shutdowns, it checks for any remaining running VM processes using esxcli. If any VMs are still active, it forcefully terminates them by killing their associated world processes. In effect, it ensures that all VMs are stopped, using escalation from graceful shutdown to hard kill only when necessary. Enumerate all registered VMs (popen, output parsed line by line) vim-cmd vmsvc/getallvms | tail -n +2 Power off each VM gracefully (one system() call per VM, skipping --ignore list) vim-cmd vmsvc/power.off > /dev/null 2>&1 After 8-second sleep: enumerate still-running VM processes (popen) esxcli --formatter=csv vm process list | tail -n +2 Force-kill any remaining VM processes by world-id (one per process) esxcli vm process kill --type=force --world-id= > /dev/null 2>&1 Persistence The ransomware copies itself to /bin/.vmware-authd mimicking a legitimate VMware daemon. Adds a second persistence layer via crontab. At every reboot, after a 60-second delay, the ransomware relaunches via the hidden binary with the original arguments. The ransomware modifies a VMware ESXi host to prepare the storage layer for fast, consistent disk writes and then disables automatic VM recovery. It increases the VMFS write buffer capacity and adjusts the flush interval to control how data is committed to disk, then forces synchronous writes across all VMFS datastores by briefly creating and deleting eager-zeroed thick disks. Finally, it clears and disables the VM autostart configuration so virtual machines will not restart automatically after a reboot. Maximize VMFS write buffer capacity (speeds up encryption throughput) esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity > /dev/null 2>&1 Reduce buffer flush interval (forces faster disk commit) esxcfg-advcfg -s 20000 /BufferCache/FlushInterval > /dev/null 2>&1 Create eagerzeroedthick disk on every VMFS-5 datastore (forces buffer flush before encryption — ensures plaintext is written to disk) for I in $(esxcli storage filesystem list | grep 'VMFS-5' | awk '{print $1}'); do \\ vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk > /dev/null 2>&1; \\ vmkfstools -U $I/eztDisk > /dev/null 2>&1; \\ done 2>&1 Same as above for VMFS-6 datastores for I in $(esxcli storage filesystem list | grep 'VMFS-6' | awk '{print $1}'); do \\ vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk > /dev/null 2>&1; \\ vmkfstools -U $I/eztDisk > /dev/null 2>&1; \\ done 2>&1 Clear ESXi VM autostart configuration (prevents VMs from restarting) vim-cmd hostsvc/autostartmanager/clear_autostart > /dev/null 2>&1 Disable autostart manager entirely vim-cmd hostsvc/autostartmanager/enable_autostart 0 > /dev/null 2>&1 Directories, Filenames and Extensions Exclusion The ransomware implements a targeted exclusion list to avoid encrypting critical components of the underlying VMware ESXi / Linux-based operating system, as well as associated virtualization and boot infrastructure. The activity surrounding The GentlemenRaaS underscores how quickly a well‑designed affiliate program can evolve from newcomer to a high‑impact ecosystem player. By combining a versatile, multi‑platform locker set with built‑in lateral movement, Group Policy–based mass deployment, and strong defense‑evasion capabilities, the operation enables even moderately skilled affiliates to execute enterprise‑scale intrusions with ransomware detonation as the final stage. The observed use of SystemBC alongside Cobalt Strike, and the discovery of a botnet with more than 1,570 likely corporate victims, further highlights that The Gentlemen affiliates are not operating in isolation, but are actively integrating into a broader toolchain of mature, post‑exploitation frameworks and proxy infrastructure. Organizations should therefore treat The Gentlemen not as an isolated family, but as part of a wider, modular intrusion ecosystem where initial access, post‑exploitation, and encryption capabilities can be rapidly recombined and reused across campaigns. Indicators of Compromise Yara Rule rule thegentlemen_ransomware { meta: author = "@Tera0017/Check Point Research" description = "The Gentlemen Ransomware written in GO." strings: $string1 = "Silent mode (don't rename files)" ascii $string2 = "Encrypt only mapped and UNC network shares" ascii $string3 = "README-GENTLEMEN.txt" ascii $string4 = "gentlemen.bmp" ascii $string5 = "gentlemen_system" ascii $string6 = "[+] Encryption started. Going background..." ascii $string7 = "[+] FULL Encryption started" ascii condition: uint16(0) == 0x5A4D and 4 of them } Ransomware Note – README-GENTLEMEN.txt Windows Version: {VICTIM_ID} {VICTIM}= YOUR ID Gentlemen, your network has been encrypted. 1. Any modification of encrypted files will make recovery impossible. 2. Only our unique decryption key and software can restore your files. Brute-force, RAM dumps, third-party recovery tools are useless. It’s a fundamental mathematical reality. Only we can decrypt your data. 3. Law enforcement, authorities, and “data recovery” companies will NOT help you. They will only waste your time, take your money, and block you from recovering your files — your business will be lost. 4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network. 5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks. In addition, it will be reported to the relevant data protection authorities and regulators. This may result in official investigations, significant fines, and reputational damage for your company. 6. We guarantee 100% file recovery to their original state, bit by bit. To demonstrate the quality of our work, you can provide three sample files, and we will restore them free of charge. TOX CONTACT - RECOVER YOUR FILES Contact us (add via TOX ID): D527959A7BC728CB272A0DB683B547F079C98012201A48DD2792B84604E8BC29F6E6BDB8003F Download Tox messenger: Contact us (add via Session ID): {SESSION_ID} Download Session СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER) Check our blog: hxxp://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ Download Tor browser: Follow us on X: hxxps://x.com/TheGentlemen25 Any other means of communication are fake and may be set up by third parties. Only use the methods listed in this note or on the specified website. After adding (us) in Tox or Session, please wait for your request to be processed and stay online. If you do not receive a reply within 36 hours, create another account and contact us again. In your first message in chat, immediately provide your ID from the note and the name of your organization. Assign one person as contact responsible for all negotiations. Do not create multiple chats. ESXi Version: {VICTIM_ID} = YOUR ESXI ID Gentlemen, your ESXI has been encrypted. 1. Any modification of encrypted files will make recovery impossible. 2. Only our unique decryption key and software can restore your files. Brute-force, RAM dumps, third-party recovery tools are useless. It’s a fundamental mathematical reality. Only we can decrypt your data. 3. Law enforcement, authorities, and “data recovery” companies will NOT help you. They will only waste your time, take your money, and block you from recovering your files — your business will be lost. 4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network. 5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks. In addition, it will be reported to the relevant data protection authorities and regulators. This may result in official investigations, significant fines, and reputational damage for your company. 6. We guarantee 100% file recovery to their original state, bit by bit. To demonstrate the quality of our work, you can provide two sample files, and we will restore them free of charge. TOX CONTACT - RECOVER YOUR FILES Contact us (add via TOX ID): D2CBA43A1AF6D965432AE11487726DB84D2945CF2CD975D7774B76B54AF052418AC2E59ADA69 Download Tox messenger: Contact us (add via Session ID): {SESSION_ID} Download Session СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER) Check our blog: hxxp://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ Download Tor browser: Follow us on X: Any other means of communication are fake and may be set up by third parties. Only use the methods listed in this note or on the specified website. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.