The Gentlemen Ransomware: Attack Chain, IOCs, and Incident Response Guide

The Gentlemen is a Go-based cyberthreat group that has listed 923 victims across 90 countries since it surfaced in 2025, and it was still posting new victims in October 2026. The group targets Windows systems across global industries.

Suspect Gentlemen activity right now? Contact the Proven Data emergency response team or see our incident response services.

The Gentlemen ransomware at a glance

What is The Gentlemen ransomware?

The Gentlemen is a Ransomware-as-a-Service (RaaS) operation first observed in mid-2025 that follows a double-extortion model: it steals data before encrypting it and publishes it on a Tor leak site if the ransom is not paid.

How The Gentlemen's affiliate program works

• Recruitment: In September 2025, the operators advertised on the RAMP forum, offering affiliates a 90/10 revenue split. The program prohibits targeting organizations in Russia and CIS countries.
• Partnerships: A recruitment partnership with BreachForums to onboard initial access brokers and penetration testers.
• Tooling: Affiliates get customizable builds and lockers for Windows, Linux, BSD, NAS, and ESXi. There are documented GentleKiller EDR-killer variants, and forum posts say the most sensitive tools are limited to trusted affiliates.
• Operator structure: SOCRadar analyzed leaked chat logs describing an administrator and nine operators with defined roles, including senior trainers, affiliates, and technical contributors.
• Affiliate variation: Experts reported on October 6, 2026, that an affiliate called Azazel, who also ran a separate leak site, used stolen GitLab CI/CD secrets to breach more than two dozen organizations in six countries. A forum discussion also said the locker was partly built with "vibecoding" techniques; treat that as unverified.

That variation matters for defenders. As Magdy Abdelaziz, Head of DFIR at Proven Data, explains: "you can face a meticulous intrusion or a sloppy one under the same brand."

The Gentlemen: origins and attribution

The earliest documented victim is JN Aceros, a Peruvian steel company compromised on June 30, 2025.

Researchers have linked the operation to an actor using the alias "hastalamuerte," who sought access to Qilin, Embargo, LockBit, Medusa, and BlackLock before building a platform. A separate alias, "Zeta88 (believed to be the same operator under the alias hastalamuerte)," advertised the program on RAMP.

The group's technical sophistication from launch, which was more polished than a typical newcomer, fueled debate over whether The Gentlemen is a rebrand of an established operation. No definitive link to a predecessor group has been publicly confirmed. FortiGuard also notes that the precision of some intrusions suggests a small core team may be operating directly.

In May 2026, a breach at a hosting provider (4VPS) exposed about 16 GB of the group's internal data, including chat logs and server credentials. But the leak didn't seem to slow the group down, since new victims kept appearing on the leak site afterward.

Who does The Gentlemen ransomware target?

The Gentlemen targets medium to large enterprises with centralized Active Directory, and its listed victims concentrate in manufacturing, technology, and professional services.

Beyond that industry concentration, confirmed targets also include hospitals, school districts, energy providers, municipal governments, and multinational manufacturers.

The spread across 90 countries, combined with the CIS exclusion, points to selection based on available access rather than a regional strategy. The US is the most targeted country, counting 168 listed victims as of early October 2026.

How does The Gentlemen ransomware attack unfold?

A Gentlemen intrusion runs in six phases: edge access, discovery and credential theft, EDR neutralization, domain-wide deployment, exfiltration, and selective encryption.

Phase 1: Initial access

Affiliates enter through compromised VPN credentials without MFA and exposed administrative panels on edge devices. In the most documented intrusion, an exposed FortiGate appliance was the entry point.

In March 2026, it was reported that the group's primary vector is CVE-2024-55591, a FortiOS authentication bypass, seen in actual intrusions, and that the group reportedly keeps a database of about 14,700 FortiGate devices it has already exploited. Initial access brokers are a plausible source, given the volume of intrusions.

Phase 2: Discovery, credential access, and staging

Operators map the network with Advanced IP Scanner, SoftPerfect Network Scanner, and Nmap, and use PuTTY to reach Linux systems and appliances. They located the LSASS process ID with tasklist and then ran Mimikatz.

Tools are staged in C:\PerfLogs, a legitimate directory that rarely triggers alerts. Operators add compromised accounts to Domain Admins using native net group commands.

Phase 3: Defense evasion and BYOVD

The group uses a Bring Your Own Vulnerable Driver (BYOVD) technique with ThrottleStop.sys, renamed ThrottleBlood.sys, exploiting CVE-2025-7771 to gain kernel privileges and terminate protected security processes.

Custom tools All.exe and Allpatch2.exe drive the abuse. Experts also document GentleKiller variants using drivers such as nogbc.sys, G11.sys, and dmx.sys. Operators then disable Defender real-time protection, add global exclusions, and use ICACLS to grant Everyone full control over target directories.

Amr Fathy, Senior DFIR Engineer at Proven Data, describes the effect: "The driver loads, EDR goes blind, encryption begins within seconds."

Phase 4: Lateral movement and domain-wide deployment

Movement relies on PsExec, PowerRun, and AnyDesk. It was also observed that Cloudflared tunnels were installed as services, Datto RMM was used, and RDP was opened via netsh advfirewall.

The attacker manipulates Group Policy Objects to push the payload through NETLOGON shares, so many hosts execute it at once. Microsoft describes a --spread mode where the encryptor copies itself to C:\Temp, creates a hidden SMB share, and tries up to 21 remote execution techniques per host.

Remote execution runs as scheduled tasks (gentlemen_system, UpdateUser, UpdateSystem) with LOCKER_BACKGROUND=1 set.

Phase 5: Data exfiltration

Rclone is the preferred exfiltration tool, tuned with options such as --transfers 8 --max-age 4y and sending data to victim-specific cloud storage such as Wasabi.

Restic, MEGAsync, and MinIO Client also appeared, and WinSCP was documented in an earlier intrusion. Affiliates must upload stolen data to approved cloud resources to stage it for leak sites.

Phase 6: Encryption and impact

Before encrypting, the payload stops database engines (MSSQL, MySQL, PostgreSQL, MongoDB, Oracle), backup services such as Veeam, virtualization services, remote tools, and Exchange.

It deletes shadow copies with vssadmin and wmic, clears event logs with wevtutil, wipes Prefetch, and deletes PowerShell history. Afterward, it deletes itself with a delayed command unless --keep is set; --wipe also overwrites free disk space.

Each file gets its own ephemeral Curve25519 key pair, and the derived key encrypts the file data via XChaCha20.

Files under 1 MB are fully encrypted; larger files are encrypted in three chunks at distributed offsets, sized by speed mode:

The binary requires --password; a wrong value prints "bad args" and exits, which blocks casual sandbox detonation. Scope flags are --system (local drives as SYSTEM), --shares (network shares), and --full (both, as two processes). --silent disables file renaming and timestamp changes.

What are The Gentlemen ransomware IOCs?

The most reliable Gentlemen indicators are the README-GENTLEMEN.txt ransom note, a renamed ThrottleStop driver, gentlemen_system scheduled tasks, and C:\PerfLogs staging. Indicators are grouped by category below. Defang before sharing.

Files and host artifacts

Tools and drivers

Commands and behaviors

Network, contact, and hash indicators

The Gentlemen ransom note content

The Gentlemen drops this note in every encrypted directory. Identifying details (victim ID, Tox ID, onion address) are redacted; everything else is reproduced as written.

Gentlemen ransom note transcript

*************************** = YOUR ID

Gentlemen, your network is under our full control.
All your files are now encrypted and inaccessible.

1. Any modification of encrypted files will make recovery impossible.
2. Only our unique decryption key and software can restore your files.
Brute-force, RAM dumps, third-party recovery tools are useless.
It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc).
If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.

TOX CONTACT – RECOVER YOUR FILES
Contact us (add via TOX ID): **************************************************************
Download Tox messenger: https://tox.chat/download.html

COOPERATE TO PREVENT DATA LEAK (239 HOURS LEFT)
Check our blog: http://*******************************.onion/
Download Tor browser: https://www.torproject.org/download/

Any other means of communication are fake and may be set up by third parties.
Only use the methods listed in this note or on the specified website.

DO NOT PAY THE RANSOM. Payment does not guarantee a working decryptor or deletion of stolen data. Read our analysis of the pros and cons of paying ransomware before any decision.

How does The Gentlemen map to MITRE ATT&CK?

The Gentlemen's observed behavior maps to 17 ATT&CK techniques. These IDs were assigned by Proven Data from vendor descriptions. The vendor reports reviewed did not publish their own full mappings.

What should you do if The Gentlemen is active in your network?

Cut the Group Policy distribution path and isolate the network first, because a Gentlemen deployment can go from policy change to mass encryption in minutes.

Abdelaziz ranks three actions above everything else:

1. Sever the distribution mechanism. Unlink the malicious GPO and disable the compromised privileged accounts that created it. Treat domain controllers as contested while the attacker holds Domain Admin.
2. Contain at the network layer, even at full business cost. Disable switch ports and block SMB. Power off machines mid-encryption to save what is still untouched.
3. Isolate the recovery tier. Physically isolate backup infrastructure and storage snapshots, because, in his words, "Gentlemen's entire model bets you have nothing clean to come back to."

Beyond those top three priorities, preserve the ransom note, the leak-site listing, and driver and memory evidence before any reimaging, and coordinate over an out-of-band channel.

The ransom note gives roughly 10 days before publication. Treat that as a planning horizon: spend the first days scoping what was taken, and prepare notifications and regulatory filings in parallel.

Is a public decryptor available for The Gentlemen ransomware?

As of October 2026, no public decryptor for The Gentlemen has been identified. Each file is encrypted with its own ephemeral Curve25519 key and XChaCha20, no private key material is stored on the victim system, and no cryptographic weakness has been reported.

Proven Data's ransomware recovery services cover restore planning and validation.

Security checklist

Each control below is tied to a technique described above.

• Phase 1: Patch FortiOS against CVE-2024-55591, remove public admin interfaces, and enforce MFA on all VPN and remote access.
• Phase 2: Alert on process execution from C:\PerfLogs and on LSASS access.
• Phase 3: Enable Microsoft's vulnerable driver blocklist or WDAC, and alert on ThrottleStop.sys or ThrottleBlood.sys loads.
• Phase 4: Turn on EDR tamper protection and alert on Defender exclusion changes and Set-MpPreference use.
• Phase 5: Alert on GPO changes and new scripts in NETLOGON, and limit GPO edit rights to a few accounts.
• Phase 6: Alert on new SYSTEM scheduled tasks, including gentlemen_system and UpdateUser, and on unexpected PsExec, PowerRun, AnyDesk, Datto RMM, or Cloudflared services.
• Phase 7: Monitor egress for Rclone, WinSCP, and large uploads to cloud storage.
• Phase 8: Keep Veeam and backup stores off the domain, with immutable offline copies, and test restores.
• Phase 9: Alert on mass service stops, shadow copy deletion, and wevtutil log clearing, and enable PowerShell Script Block Logging.

Treat two or more of these signals within a short window, especially Defender tampering followed by shadow copy deletion, as a probable ransomware incident requiring immediate containment.