Gentlemen Ransomware Targets Windows, Linux, NAS, BSD, and ESXi Systems

Key Takeaways

• The Gentlemen ransomware group has rapidly emerged as a significant threat, becoming one of the top two most active ransomware operations globally by early 2026.
• This sophisticated ransomware is highly versatile, capable of targeting a broad spectrum of enterprise systems, including Windows, Linux, NAS, BSD, and VMware ESXi environments.
• The group employs a double extortion strategy, encrypting files and exfiltrating sensitive data to pressure victims, and operates with a structured affiliate model linked to the Qilin ecosystem.
• Defenders should prioritize securing internet-facing infrastructure, enforcing multi-factor authentication, and actively hunting for early-stage attack indicators.

The Gentlemen, a ransomware collective, has rapidly escalated its operations to become one of the most aggressive and pervasive cybercriminal threats observed in recent years. This group has demonstrated remarkable adaptability, deploying ransomware across a diverse range of operating systems, including Windows, Linux, network-attached storage (NAS) devices, BSD, and VMware ESXi systems. A detailed analysis of their tactics, techniques, and procedures (TTPs) has been compiled by researchers, highlighting the extensive nature of their attack capabilities.

Emerging publicly in the latter half of 2025, The Gentlemen quickly scaled its activities, establishing itself among the two most prolific ransomware groups worldwide by early 2026. This rapid growth is attributed not only to the speed of their operations but also to the wide array of systems they compromise and the sophisticated organizational structure supporting their campaigns.

Operational Modus Operandi

The group executes its attacks through a meticulously organized workflow. Initial access is typically gained via compromised credentials or exploiting vulnerabilities in exposed remote services. Once inside a network, the ransomware is deployed to encrypt critical systems. In addition to file encryption, The Gentlemen employs a double extortion tactic, exfiltrating sensitive data prior to encryption. This stolen information serves as additional leverage, increasing pressure on victims to comply with ransom demands.

Analysts at LevelBlue indicated in a report shared with Cyber Security News (CSN) that The Gentlemen is not an entirely new entity. Instead, it appears to be a continuation of prior ransomware affiliate activities associated with the Qilin ecosystem. This lineage suggests the group is managed by a Russian-speaking actor known as “hastalamuerte.” This background provides The Gentlemen with a significant operational advantage, leveraging existing knowledge, established affiliate networks, and seasoned experience in orchestrating ransomware campaigns.

The Gentlemen Ransomware

By May 10, 2026, The Gentlemen had publicly claimed responsibility for 352 attacks within the first half of the year alone. Data from their leak site reveals victims across more than 70 countries, with significant representation from the APAC region, Europe, Latin America, and North America. The most frequently targeted sectors include professional services, manufacturing, technology, and healthcare.

Dark web intelligence has also unearthed an unverified lead concerning an individual offering data purportedly stolen from The Gentlemen’s internal systems for $10,000 in Bitcoin. This alleged cache included actor handles, victim negotiation logs, and file mapping data. While the authenticity of this information remains unconfirmed, it adds a layer of intrigue to an already complex operation.

The Gentlemen ransomware is specifically engineered for multi-platform attacks. The Windows variant, developed in the Go programming language, necessitates a password for execution, a mechanism designed to evade early detection and sandbox analysis. Encrypted files are appended with random six-character extensions, and victims find a ransom note titled “READMEGENTLEMEN.txt” on affected systems.

The encryption strategy is optimized for rapid and widespread damage. Smaller files undergo full encryption, while larger files are partially encrypted in chunks. This method allows the ransomware to propagate quickly across extensive environments, rendering recovery extremely challenging without the decryption key. Before initiating file encryption, the malware systematically terminates services related to databases, backups, virtualization platforms, and remote access tools, preempting straightforward restoration efforts.

Attacks targeting ESXi and other virtualization infrastructure are particularly devastating, capable of disrupting entire server estates within minutes. The group’s affiliate panel facilitates this operational model, enabling operators to generate custom payloads, manage victim negotiations, estimate potential ransom revenue, and handle the upload of stolen data from a unified backend platform.

What You Should Do

Organizations must adopt a proactive and multi-layered defense strategy to mitigate the threat posed by The Gentlemen ransomware and similar sophisticated operations.

• Secure Internet-Facing Assets: Conduct thorough audits of all internet-facing infrastructure, including VPNs, firewalls, and remote access portals. Ensure all systems are patched, securely configured, and adhere to a principle of least privilege.
• Strengthen Authentication: Implement and enforce multi-factor authentication (MFA) for all user accounts, especially privileged ones. Immediately rotate credentials that may have been exposed in previous breaches or stolen by info-stealing malware, and disable all stale or unused accounts.
• Proactive Threat Hunting: Focus on detecting early-stage attack behaviors rather than waiting for ransomware deployment. Monitor for suspicious administrative logins, the presence of unauthorized scanning tools (e.g., Nmap, Advanced IP Scanner), unexpected usage of remote access tools like AnyDesk or WinSCP, and any modifications to Group Policy or mass service shutdowns.
• Isolate and Test Backups: Ensure backup systems and ESXi environments are logically isolated from the main production network. Regularly test backup restoration capabilities to confirm data integrity and recovery readiness.
• Employee Training: Educate employees about phishing, social engineering, and the importance of strong password hygiene to prevent initial access vectors.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.