Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker

Gentlemen is a fast‑growing ransomware‑as‑a‑service (RaaS) operation now targeting Windows, Linux, NAS, BSD, and VMware ESXi with a new locker written in C for hypervisor environments.

Its multi‑platform design and strong defense‑evasion features make it a high‑impact threat to corporate networks worldwide.

The Gentlemen RaaS emerged around mid‑2025 and quickly built an affiliate ecosystem by advertising on underground forums and promising powerful tooling to “penetration testers” and skilled attackers.

The operators supply cross‑platform lockers implemented in Go for Windows, Linux, NAS, and BSD, plus an additional C‑based locker for ESXi, covering the mix of servers and hypervisors typical in corporate data centers.

The group runs a Tor leak site to publish stolen data when victims refuse to pay, enabling a double extortion model that combines encryption with public shaming.

Telemetry and leak‑site claims indicate more than 320 victims, with most attacks occurring in early 2026, showing that the RaaS program has rapidly attracted affiliates.

Check Point incident response data also links Gentlemen affiliates to a SystemBC‑powered botnet of over 1,570 compromised hosts, largely corporate and organizational systems rather than home users.

Attack chain and tools

In a documented enterprise intrusion, a Gentlemen affiliate first obtained Domain Admin access, then used that position to fan out across the network.

They deployed Cobalt Strike beacons via ADMIN$ shares, ran discovery commands such as whoami and systeminfo, and accessed internal documentation to understand the environment before detonating ransomware.

The affiliate attempted to install SystemBC (as socks.exe) to build covert SOCKS5 tunnels and stage additional payloads, but endpoint protection blocked this particular effort.

To maintain control, the attackers enabled Remote Desktop, installed AnyDesk with a hard‑coded password, and used tools like Mimikatz to harvest credentials from memory.

Once ready to encrypt, they staged the Gentlemen payload from an internal server and pushed it across endpoints using PowerShell, scheduled tasks, and Group Policy, achieving near‑simultaneous encryption across most domain‑joined systems.

Operators can fine‑tune behavior using options like –system for local drives, –shares for network paths, –spread for automated lateral movement with stolen domain credentials, and –gpo to weaponize Group Policy for domain‑wide deployment.

For detection evasion, the malware issues PowerShell commands to turn off Microsoft Defender real‑time protection and add both its own process and the entire C: drive to Defender’s exclusion lists.

It then kills a wide range of processes and services related to virtualization, databases, backup software, security tools, and productivity apps, maximizing the chance that critical data will be encrypted and recovery tools disabled.

Encryption itself relies on X25519 key exchange and XChaCha20, with “fast,” “superfast,” and “ultrafast” modes that touch only 9%, 3%, or 1% of large files while still rendering them unusable.

ESXi‑focused C locker

To extend impact into virtualized environments, Gentlemen includes a dedicated ESXi locker compiled as an ELF binary in C, optimized for VMware hypervisors.

The core Gentlemen locker is written in Go and controlled entirely through command‑line arguments, with a mandatory –password flag that must match a hard‑coded value inside the binary before encryption begins.

This variant exposes fewer flags than the Windows build but keeps the same password‑gated access and partial‑encryption speed modes, targeting directories such as vmfs, datastore, and mnt/storage where virtual disk files reside.

Before encryption, the ESXi locker enumerates all VMs, attempts a graceful shutdown for each, then force‑kills remaining VM processes so that virtual disk files are fully unlocked and easier to encrypt.

It persists by copying itself as bin/vmware-authd, creating boot‑time scripts in /etc/rc.local.d, and adding cron entries to relaunch after reboot, all while tuning VMFS write buffers to accelerate disk operations.

Carefully chosen exclusions avoid core ESXi system files and boot components, ensuring the hypervisor stays operational enough for victims to see the ransom note and potentially pay.

Gentlemen’s success rests on a mature, repeatable playbook: domain‑level compromise, tool‑driven lateral movement, EDR and Defender suppression, and multi‑platform lockers that reach both physical and virtual infrastructure.

Organizations should harden Domain Controllers, restrict GPO changes, monitor for tools like Cobalt Strike and AnyDesk, and enforce strong segmentation between management networks, hypervisors, and user environments to reduce blast radius if an affiliate gains a foothold.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.