Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareRansomwareExploits 3 CVEs

The Gentlemen Ransomware

The Gentlemen Ransomware is a ransomware-as-a-service (RaaS) operation first clearly observed in active campaigns beginning in August 2025 (with development indicators as early as July 2025) and described as unusually mature and operationally disciplined for a new entrant. It operates a double-extortion model: data is exfiltrated prior to encryption and victims are threatened with publication on a dark web leak site if payment is not made.

Technically, the ransomware is primarily written in Go and has variants targeting Windows, Linux, and VMware ESXi (with RaaS advertising also claiming support for Windows, Linux, NAS, BSD, and a dedicated ESXi locker). Execution requires a password parameter as a control mechanism. A September 2025 dark web post advertising “The Gentlemen’s RaaS” described an affiliate program (90% payout to affiliates), centralized operator control of infrastructure (including the leak site), TOX-based communications, and hybrid cryptography using XChaCha20 with Curve25519. Advertised/observed features include password-protected builds, partial/full encryption modes, background execution, automated network discovery, and an ESXi variant optimized for virtualized environments with multithreaded encryption and controlled VM handling.

Observed attack chain elements include initial access via exploitation of internet-exposed services or compromised administrative credentials (including exposed firewall/VPN management interfaces such as FortiGate), reconnaissance using tools like Advanced IP Scanner and Active Directory queries, UAC bypass using PowerRun.exe to execute with SYSTEM privileges, defense evasion via BYOVD using signed drivers and custom tooling (e.g., All.exe with ThrottleBlood.sys) to terminate AV/EDR, lateral movement using PsExec over SMB admin shares, and deployment via domain resources such as NETLOGON shares. Encrypted files are reported to be appended with the .7mtzhh extension and ransom notes named README-GENTLEMEN.txt are dropped.

Targeting is described as global, primarily impacting medium to large organizations across at least 17 countries, with manufacturing and technology among the most affected industries (also including healthcare and financial services). The content also references multiple victim claims/observations (including organizations in Japan and Indonesia) and notes continued victim additions into late 2025 and January 2026.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES
CVE-2024-55591Authentication Bypass in FortiOS and FortiProxy Node.js WebSocket ModuleExploited in the wild

Operators scanned for and exploited internet-facing vulnerabilities including the FortiOS authentication-bypass flaw CVE-2024-55591, alongside older Active Directory weaknesses like ZeroLogon and PetitPotam.

via security affairssecurityaffairs.com
CVE-2021-36942PetitPotam / Windows LSA Spoofing VulnerabilityExploited in the wild

Operators scanned for and exploited internet-facing vulnerabilities including the FortiOS authentication-bypass flaw CVE-2024-55591, alongside older Active Directory weaknesses like ZeroLogon and PetitPotam.

via security affairssecurityaffairs.com
CVE-2020-1472Zerologon in Microsoft Netlogon Remote ProtocolExploited in the wild

Operators scanned for and exploited internet-facing vulnerabilities including the FortiOS authentication-bypass flaw CVE-2024-55591, alongside older Active Directory weaknesses like ZeroLogon and PetitPotam.

via security affairssecurityaffairs.com
MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1078Valid AccountsEvidence1

“Initial Access: The attackers gain entry by… compromised administrative credentials…”

T1190Exploit Public-Facing ApplicationEvidence1

“Initial Access: The attackers gain entry by exploiting internet-exposed services… including exposed firewall and VPN management interfaces such as FortiGate appliances.”

Execution

1 technique
T1053Scheduled Task/JobEvidence1

a malicious Group Policy Object (GPO) that executed staged ransomware binaries within SYSVOL/NETLOGON via scheduled tasks across the environment

Persistence

3 techniques
T1053Scheduled Task/JobEvidence1

a malicious Group Policy Object (GPO) that executed staged ransomware binaries within SYSVOL/NETLOGON via scheduled tasks across the environment

T1078Valid AccountsEvidence1

“Initial Access: The attackers gain entry by… compromised administrative credentials…”

T1112Modify RegistryEvidence1

used multiple commands to maintain persistence, such as disabling Windows Defender, Windows Firewall, and C-drive scanning and monitoring

Privilege Escalation

3 techniques
T1053Scheduled Task/JobEvidence1

a malicious Group Policy Object (GPO) that executed staged ransomware binaries within SYSVOL/NETLOGON via scheduled tasks across the environment

T1078Valid AccountsEvidence1

“Initial Access: The attackers gain entry by… compromised administrative credentials…”

T1484.001Group Policy ModificationEvidence2

The intrusion ended in domain-wide ransomware deployment through a malicious Group Policy Object (GPO) that executed staged ransomware binaries within SYSVOL/NETLOGON via scheduled tasks across the environment.

Stealth

3 techniques
T1070Indicator RemovalEvidence2

Prior to encryption, the actor ... deleted shadow copies, cleared event logs, and removed forensic artifacts.

T1070.001Clear Windows Event LogsEvidence1

Prior to encryption, the actor ... cleared event logs

T1078Valid AccountsEvidence1

“Initial Access: The attackers gain entry by… compromised administrative credentials…”

Defense Impairment

2 techniques
T1112Modify RegistryEvidence1

used multiple commands to maintain persistence, such as disabling Windows Defender, Windows Firewall, and C-drive scanning and monitoring

T1484.001Group Policy ModificationEvidence2

The intrusion ended in domain-wide ransomware deployment through a malicious Group Policy Object (GPO) that executed staged ransomware binaries within SYSVOL/NETLOGON via scheduled tasks across the environment.

Lateral Movement

1 technique
T1570Lateral Tool TransferEvidence1

When enabled with the --spread argument, it turns the malware from a single-host encryptor into a self-propagating worm that attempts to deploy its encryptor to every reachable system on the network.

Exfiltration

1 technique
T1020Automated ExfiltrationEvidence2

While it operates fairly typical double extortion attacks (using both encryption and data leaking as extortion levers)

Impact

6 techniques
T1486Data Encrypted for ImpactEvidence6

When enabled with the --spread argument, it turns the malware from a single-host encryptor into a self-propagating worm... If the --wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine...

T1489Service StopEvidence2

Prior to encryption, the actor ... stopped virtual machines

T1490Inhibit System RecoveryEvidence1

Prior to encryption, the actor ... deleted shadow copies

T1491DefacementEvidence1

The ransomware subsequently propagated broadly throughout the domain, dropping ransom notes and modifying desktop backgrounds on impacted systems.

T1529System Shutdown/RebootEvidence1

the locker performing a controlled shutdown of all ESXi virtual machines and disabling automatic VM recovery

T1561Disk WipeEvidence1

If the --wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine to eliminate recoverable artifacts from disk.

Other

2 techniques
T1562Impair DefensesEvidence2

Prior to encryption, the actor disabled Microsoft Defender protections, added AV exclusions...

T1562.001Disable or Modify ToolsEvidence1

“Custom tools… to terminate antivirus and EDR processes… Terminates… security services”

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.