The Gentlemen: How GentleKiller Clears the Path to Encryption

The Gentlemen ransomware operation first surfaced in July 2025. Its operators had reportedly worked as affiliates for other ransomware groups before launching an independent partnership program, then moving to a public ransomware-as-a-service (RaaS) model around September 2025.

By July 2026, public tracking data had recorded 580 organizations named on the group’s leak site across 77 countries.

The Gentlemen advertises a 90 percent share of paid ransoms for affiliates, compared with the 70 to 80 percent commonly retained by affiliates in other programs. It also supplies more of the attack stack than a basic locker.

Figure 1: The Gentlemen affiliate recruitment advertised a 90 percent share.

RaaS separates the people who build and run ransomware from the criminals who breach organizations. Under this service model, operators maintain the encryptor, payment infrastructure, leak site, decryption system, and affiliate panel. Affiliates obtain access to victims, steal data, deploy the payload, and share any payment with the operators.

Security researchers found that its operators provide affiliates with Go-based ransomware for Windows and Linux environments, a C-based ESXi locker, a custom backdoor, credential theft tooling, and several endpoint detection and response (EDR) killers. Its double extortion model combines encryption with the threat of publishing stolen data.

Figure 2: The affiliate-facing panel used to build a new target.

Its in-house GentleKiller framework has at least eight observed variants. One detailed public security analysis found that the suite targets more than 400 processes associated with 48 security products, combining purpose-built code with adapted third-party tools.

The Gentlemen affiliates have used vulnerable internet-facing firewalls and VPNs, exposed remote services, stolen or weak credentials, brute force, and access purchased from initial access brokers. Some attacks move from entry to encryption within hours; in others, access appears to have existed well before the ransomware deployment.

Once inside, the affiliate maps the network and validates credentials. Observed tools include Advanced IP Scanner, native Windows utilities, and packet capture through netsh. Attackers can then move laterally through administrative shares, Remote Desktop Protocol (RDP), Server Message Block (SMB), or PsExec, aiming for domain-level privileges and access to virtual infrastructure.

Before encryption, The Gentlemen attacks the controls likely to stop it. Its operators package bring-your-own-vulnerable-driver (BYOVD) tools that load a legitimate but exploitable driver, gain kernel-level capabilities, and terminate protected security processes.

Figure 3: An EDR-killer exploit terminating a protected security process.

The encryptor supports local drives, network shares, PsExec-based spread, and deployment through Group Policy. It can stop Hyper-V virtual machines, delete Volume Shadow Copies, clear event logs, and place README-GENTLEMEN.txt ransom notes throughout encrypted directories. It uses Curve25519 and XChaCha20 for file encryption. Separate builds target ESXi and other platforms, extending the impact beyond Windows endpoints.

Figure 4: Wallpaper embedded in a Gentlemen ransomware sample.

The Gentlemen’s tooling is capable, but the attack chain still depends on exposed infrastructure, privileged access, security-tool impairment, lateral deployment, and outbound data movement.

1. Secure exposed systems and privileged access
   Patch internet-facing firewalls, VPNs, remote access gateways, and exposed RDP services according to exploitability and exposure. Require phishing-resistant multifactor authentication, separate administrative credentials across workstations, servers, backups, and virtualization platforms, and review logs for signs that vulnerable systems were compromised before they were updated.
2. Prevent unapproved drivers from loading
   Use Windows Defender Application Control or an equivalent application-control policy to restrict vulnerable and unknown kernel drivers. Alert on unexpected driver installation, EDR service termination, security exclusions, Defender registry changes, and files staged in directories such as GentlemenCollection.
3. Contain domain-wide deployment
   Segment user, server, backup, and hypervisor networks. Restrict SMB and PsExec, secure administrative shares, disable unused ESXi SSH access, and monitor Group Policy, NETLOGON, and SYSVOL for unexpected executables or scheduled tasks.
4. Block data exfiltration
   Monitor and restrict unusual outbound transfers, archive creation, unapproved cloud-storage tools, and connections to unfamiliar infrastructure. Encryption recovery does not recover information that attackers have already removed.
5. Protect and test recovery systems
   Maintain offline or immutable backups under separate credentials. Restore representative systems regularly and rehearse recovery after domain compromise, including clean-room rebuilding of identity, endpoint management, and virtualization services.

The Gentlemen can recover from a blocked tool or failed deployment path by switching to another part of its toolkit. Cybersecurity experts need separate controls for privileged access, security-tool tampering, lateral movement and outbound data transfers, with telemetry that remains available after an affiliate gains administrative access. BlackFog ADX Protect supports that layered response by monitoring and blocking unauthorized outbound transfers from endpoints.

The mappings below reflect techniques described in public reporting and technical analysis.