Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for Network Propagation

**Executive summary:** 'Gentlemen' is a Go-based ransomware-as-a-service (RaaS) active since mid-2025 that employs per-file ephemeral Curve25519 and XChaCha20 encryption, aggressive defense-evasion (disabling Defender, deleting shadow copies and logs, terminating backup/EDR services), worm-like self-propagation across networks using up to 21 remote-execution vectors, and data exfiltration for double extortion; it targets Windows systems across education, transportation, healthcare, and financial sectors worldwide and is distributed via an affiliate program.