MalwarePublished 28 May 2026

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

Source Microsoft Security Blog

Description

Microsoft Threat Intelligence presents a comprehensive analysis of The Gentlemen, a Go-based ransomware deployed by affiliates of Storm-2697 that combines per-file ephemeral key encryption with an aggressive self-propagation module to deploy itself across an entire network using series of simultaneous lateral movement techniques per target. The post The Gentlemen ransomware: Dissecting a self-propagating Go encryptor appeared first on Microsoft Security Blog .

Impact

The ransomware encrypts files on infected systems using per-file ephemeral keys, potentially causing data loss or disruption. Its aggressive lateral movement capabilities enable rapid spread across networked systems, increasing the scope of impact within an organization. There are no reports of active exploitation in the wild at this time.

Defensive guidance

Mitigation should focus on network segmentation and limiting lateral movement opportunities, although these recommendations are inferred and not explicitly stated in the advisory.

Summary

The Gentlemen ransomware is a self-propagating encryptor written in Go, deployed by Storm-2697 affiliates. It encrypts files individually with ephemeral keys and uses aggressive lateral movement techniques to spread across networks. The malware's design allows it to deploy itself widely within a target environment by leveraging multiple simultaneous propagation methods. The analysis is based on a detailed Microsoft Security Blog article. No specific affected software versions or patches are identified, and no known exploits in the wild have been reported.

References

microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 May 2026, 22:04 UTC

References

Community reviews