Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for Network Propagation

Gbhackers •Mayura Kathir • July 6, 2026

Gentlemen, a Go-based ransomware-as-a-service (RaaS) active since mid-2025, has distinguished itself with a potent combination of modern cryptography, aggressive worm-like propagation, and a broad toolkit for remote execution. Operators offer the platform to affiliates, and recent recruitment ties to major breach forums appear to have expanded its reach since the affiliate program launch in late […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gentlemen Ransomware Uses Advanced Techniques for Network Attacks The Gentlemen ransomware, a Go-based RaaS, has been active since mid-2025 and employs aggressive propagation methods. It utilizes 21 remote execution techniques, including PsExec, WMIC, and PowerShell Remoting, to encrypt entire networks from a single compromised machine. The malware is designed to spread rapidly across corporate environments, posing a significant threat to organizations. Disguised with a tool called Garble, it combines strong encryption with a self-spreading worm engine. The ransomware's affiliate program has expanded its reach, with ties to major breach forums. As of now, organizations are urged to bolster their defenses against this evolving threat. 3 sources 71

Extracted Entities

Go-Based Gentlemen Ransomware Uses PsExec, WMIC, and PowerShell Remoting for Network Propagation

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (4)

Ransomware Groups (1)

Tools (3)