The Gentlemen the Ransomware operation that professionalized crime and points to global networks

In recent months, an uncomfortable truth has again been revealed: the ecosystem of the Ransomware has been professionalized to look like an industry in the service of crime. A recent and particularly striking example is the operation known as The Gentlemen, a Ransomware-like-service (RaaS) service that, since its appearance in July 2025, has climbed rapidly and sophisticated to operate on a large scale.

Security investigators have detected that actors linked to The Gentlemen tried to deploy a known malicious proxy called SystemBC. The firm Check Point Research found that the command and control server (C2) associated with SystemBC allowed to discover a botnet that affects more than 1,570 corporate networks. SystemBC is not a simple backdoor: it sets SOCKS5 tunnels within the compromised environment and communicates with its C2 by means of an encrypted protocol with RC4, as well as being able to download and run payloads that can be written on disk or injected directly into memory. These details are included in the analysis of firms and industry publications, including the public notes of safety manufacturers. (Check Point Research)

The versatility of The Gentlemen partly explains its expansion: it operates under a double extortion scheme and has shown the ability to affect Windows, Linux, NAS and BSD environments. Its cipher is developed in Go and the group combines legitimate tools - such as adulterated drivers - with its own malicious utilities to evade controls. The usual chain of intrusion begins with initial access which, for now, is not fully clarified: everything points to the abuse of services exposed to the Internet or committed credentials. From there they perform internal recognition, lateral movement, staging of loads such as Cobalt Strike or SystemBC, avoidance techniques and finally deployment of the ransomware.

A dangerously effective feature is the exploitation of domain directive objects (GPO) to spread scale changes in corporate networks and achieve a massive commitment in a single blow. In addition, research by other suppliers has documented how The Gentlemen operators adapt their tools and tactics to the defenses detected in each victim, which involves a phase of deep recognition and software modifications to address specific security solutions. (Trend Micro)

In the case observed by Check Point, an affiliate deployed SystemBC in a committed host and C2 linked to this proxy was controlling hundreds of victims worldwide, with reported incidents in the United States, the United Kingdom, Germany, Australia and Romania. Although SystemBC has been known at the cybercrime scene since 2020, it is not clear to what extent it is part of the standard script of The Gentlemen or whether it was used by a specific affiliate for exfiltration and remote access tasks in this campaign.

The modus operandi during the lateral movement reveals a methodical approach to neutralizing defenses: the attackers push PowerShell scripts that try to deactivate the real-time protection of Windows Defender, add extensive exclusions for disks and processes, turn off the firewall, reactivate SMBv1 and relax anonymous access controls of the LSA subsystem, all before deploying the encryption binary into the remote machine. These actions show a clear intention to leave the ground as clean as possible for continuous encryption.

When the victim is a VMware ESXi server, the Ransomware variant is simplified in functionalities, but it incorporates specific actions for virtualized environments: it switches off virtual machines to facilitate impact, it persists by scheduled crontab-type tasks and runs steps to prevent recovery before encryption. This specialization between Windows and ESXi variants is a trend that we are increasingly seeing in operators who want to maximize damage to critical infrastructure.

In the words of one of the researchers who accessed the group's operational servers, the commercial architecture of The Gentlemen is part of the success: they have managed to attract affiliates by offering them more advantageous conditions than competition, and what emerged from the internal analysis was a network of more than 1,570 committed corporate networks that had not yet appeared on the public lists of victims. This figure suggests that the actual magnitude of the operation far exceeds what is known on the surface.

Meanwhile, other Ransomware actors and families continue to evolve. The Rapid7 firm has documented the appearance of Kyber, a relatively new family that became public in September 2025 and which points to both Windows and VMware ESXi infrastructure. Kyber uses Rust-written ciphers for the Windows variant and C + + for the ESXi-attacking variant; the latter includes data encryption capabilities, optional completion of virtual machines and even the defacement of management interfaces, which shows a trend towards platform specialization rather than unnecessary complexity. (Rapid7)

Data added by several observers show that the pressure of the attacks does not refer to: according to incident compilations, in the first quarter of 2026 at least 2,059 incidents of ransomware and digital extortion were recorded, with March as peak month and more than 700 events. Among the most active groups in that period were Qilin, Akira, The Gentlemen, INC Ransom and Cl0p. A striking aspect in the case of The Gentlemen is the regional variation of its victims: in previous quarters the percentage of targets in North America varied significantly, which breaks with the usual patterns of other digital extortion collectives. (ZeroFox)

The broader reports on the evolution of the Ransomware point to a ripening of the phenomenon: it has become a business-oriented criminal machinery, with shared supply chains, role specialization and rapid regeneration after police interventions. Trends such as attempts to cancel Endpoint Detection and Response solutions, the re-use of vulnerable drivers as a climbing vector (Bring Your Own Vulnerable Driver), the diffuse between state and criminal campaigns and a greater focus on SMEs and operational technology environments have been described by industry analysts. The automotive sector, for example, doubled the number of incidents in 2025 and concentrated a significant part of the incidents reported in this area. (CISA)

Another worrying fact is that the attacker's time of stay within the networks (dwell time) has been drastically reduced: many intrusions are orchestrated and run during nights and weekends to gain speed and to subtract response capacity from the security team. A high percentage of attempts are made in strips where supervision is weaker, and some actors like Akira have demonstrated the ability to climb from the first intrusion to the complete encryption within an hour in certain scenarios.

In view of this scenario, the recommendation for security teams and IT officials is prospective and practical: to tighten the exposure of services to the Internet, to apply multifactor authentication and to rotation of credentials, to segment networks to limit the scope of the lateral movement, to monitor and restrict changes in GPOs, to maintain offline and validated backup and, essentially, to have rapid response strategies that contemplate night and weekend detection. In addition, it is essential to apply the guides and resources published by official agencies and security providers to strengthen endpoints and virtualized environments. (Microsoft Security)

The reality is that we face rivals that operate as business: they compete for affiliates, specialize tools according to the objective and optimize processes to cause maximum damage in the shortest time. Knowing their tactics and applying corresponding defenses does not guarantee immunity, but it does reduce the surface of attack and the likelihood of becoming the next victim spread into a public list of extortion. For those who want to deepen public research and recommendations, the reports of the response teams and the publications of the manufacturers remain an essential source of intelligence. (The Hacker News) It also offers continuous coverage that synthesizes real-time findings and updates.