Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for ...

Gentlemen, a Go-based ransomware-as-a-service (RaaS) active since mid-2025, has distinguished itself with a potent combination of modern cryptography, aggressive worm-like propagation, and a broad toolkit for remote execution.

Operators offer the platform to affiliates, and recent recruitment ties to major breach forums appear to have expanded its reach since the affiliate program launch in late 2025.

Technically, Gentlemen is notable for three capabilities that increase both impact and survivability: per-file ephemeral-key encryption using Curve25519 and XChaCha20, an extensive defense-evasion sequence that sabotages recovery and detection, and a self-propagation module that tries up to 21 remote-execution techniques per target host.

The hybrid encryption scheme generates a new Curve25519 ephemeral key pair for every file, derives an ECDH shared secret with an embedded operator public key, and uses that secret as the XChaCha20 key while taking the nonce from the ephemeral public key.

The ephemeral public key is appended to the encrypted file footer, enabling decryption only for an actor who possesses the operator’s private key.

Files are renamed with the .umc16h extension; small files are fully encrypted while large files receive multiple encrypted chunks with per-chunk nonce variation to avoid keystream reuse.

This design yields fast, robust encryption with strong per-file uniqueness, complicating offline recovery.

Researchers in Picussecurity said , Gentlemen, Written in Go and obfuscated with Garble, Gentlemen targets Windows environments across education, transportation, healthcare, and financial sectors on five continents.

On initial execution, Gentlemen requires an operator-supplied password and can elevate to SYSTEM via scheduled-task creation when the –system or –full flags are used.

Before encryption begins, the malware runs an automated defense-evasion routine: it disables Microsoft Defender access and adds broad exclusions, deletes Volume Shadow Copies and prefetch artifacts, wipes logs and PowerShell histories, and terminates services and processes for databases, backup solutions, EDR agents, and virtualization platforms.

The propagation module is where Gentlemen behaves like a worm. When invoked with –spread (using explicit credentials or the current session token), the infected host copies the binary to C:\Temp, exposes a hidden anonymous SMB , drops PsExec, and enumerates reachable systems.

Against each target it first executes a compact PowerShell “defense-evasion blob” remotely to disable Defender, firewall profiles, enable legacy SMB1, and relax anonymous-access registry values.

It then attempts a sequence of remote-execution methods remote file copy to administrative shares, PsExec, WMIC, scheduled tasks, service creation, PowerShell remoting (WinRM), and direct WMI process creation up to 21 distinct operations per host.

This redundancy is intentional: even hardened networks frequently have at least one enabled vector that allows lateral movement.

Operators combine encryption with data theft for double extortion: exfiltrated data is threatened with public release if ransom demands are not met.

The Picus Platform includes modules to simulate Gentlemen ransomware attacks across both network infiltration and email infiltration vectors, enabling defenders to validate controls against its tactics.

Detection and mitigation should focus on reducing the available lateral vectors and limiting credential reuse: enforce least privilege and segmentation, disable legacy SMB1, block or restrict administrative shares and remote execution tools, apply robust EDR with behavioral detections for mass file access.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A newly disclosed vulnerability in the Linux kernel, tracked as CVE-2026-53359 and named “Januscape,” reveals…

A recent security audit of PHP’s PDO ecosystem uncovered a denial-of-service vector in the pdo_pgsql…

A sophisticated interview-themed phishing campaign that impersonates major global brands to harvest Gmail credentials. Attackers…

Authorities used a persistent Windows Global Device ID, along with VPN telemetry and cloud service…

A coordinated social-engineering campaign observed in late June 2026 combined email phishing with an abused…

BeyondTrust has disclosed multiple critical and high-severity vulnerabilities affecting its Remote Support (RS) and Privileged…