The Gentlemen RaaS Turns Infected Hosts Into SMB Distribution Points for Rapid Spread

The Gentlemen ransomware is a Go-based, heavily obfuscated RaaS with aggressive worm-like SMB propagation and double extortion, targeting education, healthcare, transportation, and financial sectors worldwide; it uses build-specific password gating, disables defenses, destroys backups, establishes persistence, and spreads via hidden SMB shares and remote execution tools (PsExec, WMI, PowerShell).