The Gentlemen ransomware group has emerged in 2026 as a highly adaptive and technically sophisticated ransomware-as-a-service (RaaS) operation targeting large corporations and critical infrastructure across multiple regions.
Public reporting places The Gentlemen among the top 10 ransomware actors by victim announcements on its data leak site during the first half of 2026 (see ransomware.live/stats/2026), and telemetry indicates a rapid operational ramp-up since February 2026.
Our independent analysis reveals novel tactics, custom tooling, and multi-stage tradecraft that underscore the group’s growing operational maturity and risk to enterprise networks.
Initial access commonly stems from exploitation of exposed network appliances and compromised credentials.
The Gentlemen ransomware attacks and affiliates frequently target internet-facing VPNs and firewalls, using leaked or default credentials and, in many cases, purchasing initial access from brokers.
In several incidents ransomware was deployed within hours of access; in others, access had been maintained for weeks or months suggesting collaboration with separate initial access providers or other threat actors prior to ransomware detonation.
Once inside, the group conducts methodical internal reconnaissance. Operators deploy tools such as SharpADWS for Active Directory enumeration, NetScan and Advanced IP Scanner for network discovery, and leverage Microsoft’s netsh to capture packet traces into administrative shares for off-host analysis with Wireshark.
This blend of AD-focused discovery and network sniffing enables the attackers to harvest credentials and map high-value assets before moving laterally.
According to Securelist, Gentlemen since February 2026 and have discovered new tactics, techniques, and procedures (TTPs) as well as custom tool development efforts, as they target large corporations and critical infrastructure worldwide.Â
Lateral movement uses both established and bespoke techniques. The Gentlemen distribute payloads via the NETLOGON share and a custom PowerShell deploy_gpo.ps1 for rapid Group Policy-based propagation from Domain Controllers.
The Gentlemen Ransomware
PsExec is used as an alternative spread mechanism; when absent, attackers retrieve it from Microsoft Sysinternals.
The group’s GPO workflow includes creating fake update policies to disable Windows Defender and forcing immediate group policy refreshes with gpupdate /force, causing near-simultaneous infection across domains.
A prominent evasion strategy is BYOVD (bring-your-own-vulnerable-driver). The group has abused multiple legacy and third-party drivers ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, inpoutx64.sys, wsftprm.sys and others to disable or bypass security products.
They also use kernel-level tools like Windows Kernel Explorer and OpenArk64 and simpler mechanisms such as kavrmvr.exe and registry modifications to turn off Defender real-time protection and add exclusions.
The Gentlemen’s toolset includes a Go-based backdoor and a Go-based cross-platform ransomware, alongside C-based implants (including an ESXi locker and a developing Windows C variant).
The Go backdoor establishes persistent Yamux-based TCP C2 channels, exfiltrates host metadata, spawns SOCKS proxies, and executes remote commands capabilities that materially expand reconnaissance and pivoting.
The Go ransomware, first seen mid-2025 and prevalent in 2026, uses an obfuscator to frustrate analysis and accepts numerous runtime flags (–gpo, –spread, –system, –wipe, etc.) that enable controlled, targeted encryption campaigns.
Encryption employs modern cryptography: the Go variant uses Curve25519 with XChaCha20 while the C variant (still evolving) leverages AES-256-GCM with RSA-wrapped keys.
Both families implement anti-analysis measures, notably password gating (current sample password: CbdU8EgF) to avoid sandbox execution.
Pre-encryption steps are comprehensive stopping Hyper-V VMs, killing backup and database processes, clearing shadow copies and event logs, and altering file ACLs to ensure full control over targets.
Victims span manufacturing, IT services, healthcare, finance, construction and logistics, with heavy activity observed in Brazil, China, Indonesia, Taiwan and Thailand. Attribution to The Gentlemen and affiliates is supported by consistent artifact reuse ransom notes, DLS entries and operator infrastructure.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 operation.){kind=link}