The Gentlemen are knocking: сustom backdoors and evolving tactics

The Gentlemen ransomware-as-a-service group emerged as a top-10 threat actor in the first half of 2026. The group exploits vulnerabilities in internet-facing devices like VPNs and firewalls, potentially collaborating with initial access brokers. They employ comprehensive reconnaissance using tools like SharpADWS, NetScan, and Advanced IP Scanner, capturing network traffic with netsh. The attackers disable security products through BYOVD techniques using vulnerable drivers, and deploy custom Go-based backdoors and ransomware variants. They spread laterally via GPO deployment and PsExec, encrypt files using Curve25519 and XChaCha20, and recently developed a C-based ransomware variant using AES256-GCM and RSA. The group targets multiple industries worldwide, particularly in Brazil, China, Indonesia, Taiwan, and Thailand, with attacks focusing on manufacturing, IT services, healthcare, and financial sectors.

• Dark Web Profile: CyberXeroMalware2026-11-10
• ARTEX: Agentic AsbestosMalware2026-11-06
• New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. OrgMalware2026-11-05
• Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesMalware2026-11-03
• Belarus-Linked Hackers Deploy Wiper Malware in First Documented Destructive Attack on UkraineMalware2026-10-30