The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

Researchers found an organized, production-grade toolkit belonging to a TheGentlemen ransomware affiliate hosted in an open Proton66 directory; the toolkit includes Mimikatz logs, privilege-escalation utilities, ngrok tokens for reverse access, and a destructive pre-deployment script (z1.bat) that disables security products, purges registry entries, deletes volume shadow copies, and installs persistent backdoors, indicating active, high-impact ransomware operations.