New Gentlemen Ransomware Attacks Multiple Platforms Including ESXi and NAS

Gentlemen is a high-volume, financially motivated ransomware and extortion operation (operator "hastalamuerte") that leverages an affiliate model and existing cybercriminal access ecosystems to compromise enterprise environments across ~70 countries; it conducts double-extortion by stealing data before encrypting hosts (including VMware ESXi), uses multi-platform malware (Go-based Windows locker, hybrid partial-file encryption), terminates backups/databases, appends extensions like .7mtzhh/.ojuopo or random six-character strings, and leaves README-GENTLEMEN.txt ransom notes — telemetry attributes hundreds to over a thousand potential compromises and identifies exposed remote services, credential compromise, or purchased access as typical initial access vectors.