Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker

Gentlemen is a rapidly expanding ransomware-as-a-service operation active in early 2026 that provides cross-platform lockers (Go for general OSes and a C-based ESXi locker) to affiliates, enabling large-scale domain compromises and double‑extortion through a Tor leak site; observed TTPs include Cobalt Strike, SystemBC, AnyDesk, Mimikatz, GPO/PowerShell propagation, Defender suppression, and hypervisor-aware encryption targeting VM datastores.