The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools

The Gentlemen is a rapidly scaling ransomware-as-a-service operation active in 2026 that uses exposed edge devices, stolen credentials, vulnerable-driver attacks, and network spreading (GPO, NETLOGON, PsExec). Kaspersky and other vendors observed a Go-based backdoor and a C-based locker, sophisticated sandbox-evasion and file-encryption methods, and a data-leak extortion model impacting hundreds of large organizations across multiple industries and countries; defenders are advised to patch remote access, enforce MFA, monitor for reconnaissance and vulnerable-driver loads, and maintain offline backups.