The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation

Summary

The Gentlemen ransomware group is a Russian-speaking RaaS operation that originated as an affiliate of LockBit and Qilin before becoming independent in mid-2025. It offers affiliates up to 90% of ransom payments and has claimed over 800 victims globally. The ransomware targets multiple operating systems including Windows, Linux, NAS, and BSD. It uses a double-extortion tactic by encrypting victim files with ChaCha20 encryption and exfiltrating data for leverage. The malware terminates security software by exploiting vulnerable drivers and propagates laterally within networks using PsExec. In May 2026, an infrastructure breach revealed internal communications and affiliate data, linking it to the Qilin ecosystem. The group predominantly targets organizations in the US and Europe, focusing on sectors such as manufacturing, technology, healthcare, professional services, and retail.

Impact

The ransomware causes data encryption and data exfiltration, leading to potential operational disruption and data breaches. The use of vulnerable drivers to terminate security processes can disable endpoint defenses, increasing infection success. Lateral movement capabilities enable widespread network compromise. The double-extortion model increases pressure on victims by threatening public release of stolen data. The exposure of internal infrastructure and affiliate information may lead to further law enforcement actions or disruption of the group’s operations.

Defensive guidance

No specific patch or fix is available as this is a ransomware operation rather than a software vulnerability. Organizations should focus on detection and prevention measures relevant to ransomware, such as monitoring for lateral movement tools like PsExec, securing endpoints against vulnerable drivers, and protecting against data exfiltration. Since no vendor advisory or patch information is provided, check relevant security advisories for updates. Incident response plans should be prepared for double-extortion scenarios. Note that no known exploits in the wild are reported for CVE-2025-70795 associated with this threat.

Countries

United States