Gentlemen RaaS Attacking Windows, Linux With additional locker written in C for ESXi

Cybersecuritynews •Tushar Subhra Dutta • April 21, 2026

A new ransomware-as-a-service (RaaS) operation known as “The Gentlemen” has emerged as a serious threat to corporate networks worldwide. Since appearing around mid-2025, this group has rapidly grown into a well-organized criminal platform, publicly claiming over 320 victims, with most attacks — more than 240 — recorded in the opening months of 2026. The speed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen RaaS Targets Windows, Linux, and ESXi with New C Locker The Gentlemen ransomware-as-a-service (RaaS) operation has emerged as a significant threat to corporate networks, targeting multiple platforms including Windows, Linux, NAS, BSD, and VMware ESXi. This group has rapidly expanded since its inception around mid-2025, claiming over 320 victims, with more than 240 attacks reported in early 2026 alone. The ransomware is designed with strong defense-evasion capabilities, making it particularly dangerous for organizations. The new locker, written in C, is specifically aimed at hypervisor environments, enhancing its impact. The Gentlemen RaaS has built a well-organized affiliate ecosystem, contributing to its swift growth and increasing threat level. As of now, the operation continues to pose a high risk to various sectors worldwide. 4 sources 67

Extracted Entities

Gentlemen RaaS Attacking Windows, Linux With additional locker written in C for ESXi

The full story

Extracted Entities

Attack Types (1)

Platforms (3)

Ransomware Groups (1)