Dark Web Profile: The Gentlemen Ransomware

The report profiles "The Gentlemen," an active ransomware group first observed in mid-to-late 2025 that operates a Ransomware-as-a-Service (RaaS) double-extortion model targeting medium-to-large enterprises across at least 17 countries; it leverages cross-platform Go/C variants (Windows, Linux, ESXi), password-protected builds, and advanced evasion and lateral-movement techniques to exfiltrate data and encrypt systems, dropping .7mtzhh-encrypted files and README-GENTLEMEN.txt ransom notes while advertising affiliate terms and offering extensive features to partners.