The Gentlemen ransomware now uses SystemBC for bot-powered attacks

**Executive Summary:** Check Point Research observed a Gentlemen ransomware affiliate deploying SystemBC proxy malware, revealing a botnet of more than 1,570 likely corporate hosts across the US, UK, Germany, Australia and Romania; the intrusion involved Domain Administrator access, credential harvesting (Mimikatz), Cobalt Strike, lateral movement and GPO-driven encryption using a hybrid X25519/XChaCha20 scheme, and Check Point published IoCs and a YARA rule to aid detection.