The Gentlemen Ransomware: Rapid Evolution and Dual-Extortion

Cybereason Threat Intelligence Team has analyzed the rapidly evolving ransomware group known as The Gentlemen, which surfaced in mid-2025. The group employs a dual-extortion strategy, encrypting sensitive files and exfiltrating critical business data, threatening to publish it unless a ransom is paid. The ransomware combines advanced encryption techniques with dynamic propagation options, including WMI, PowerShell remoting, and ESXi capabilities. It features enhanced automation, stealth, and performance improvements across Windows, Linux, and ESXi variants. The ransomware is promoted as a Ransomware-as-a-Service (RaaS) on cybercrime forums, offering configurable modes, dual-extortion tactics, and strong affiliate support. The group has published 48 victims on their dark web leak site within a short period, highlighting their aggressive pace and technical sophistication.