Gentlemen RaaS Hits Windows, Linux, and ESXi With New C

Gbhackers •Mayura Kathir • April 21, 2026

Gentlemen is a fast‑growing ransomware‑as‑a‑service (RaaS) operation now targeting Windows, Linux, NAS, BSD, and VMware ESXi with a new locker written in C for hypervisor environments. Its multi‑platform design and strong defense‑evasion features make it a high‑impact threat to corporate networks worldwide. The Gentlemen RaaS emerged around mid‑2025 and quickly built an affiliate ecosystem by […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen RaaS Targets Windows, Linux, and ESXi with New C Locker The Gentlemen ransomware-as-a-service (RaaS) operation has emerged as a significant threat to corporate networks, targeting multiple platforms including Windows, Linux, NAS, BSD, and VMware ESXi. This group has rapidly expanded since its inception around mid-2025, claiming over 320 victims, with more than 240 attacks reported in early 2026 alone. The ransomware is designed with strong defense-evasion capabilities, making it particularly dangerous for organizations. The new locker, written in C, is specifically aimed at hypervisor environments, enhancing its impact. The Gentlemen RaaS has built a well-organized affiliate ecosystem, contributing to its swift growth and increasing threat level. As of now, the operation continues to pose a high risk to various sectors worldwide. 4 sources 67

Extracted Entities

Gentlemen RaaS Hits Windows, Linux, and ESXi With New C

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (5)

Ransomware Groups (1)