Gentlemen RaaS Targets Windows, Linux, and ESXi with New C Locker

The Gentlemen ransomware-as-a-service (RaaS) operation has emerged as a significant threat to corporate networks, targeting multiple platforms including Windows, Linux, NAS, BSD, and VMware ESXi. This group has rapidly expanded since its inception around mid-2025, claiming over 320 victims, with more than 240 attacks reported in early 2026 alone. The ransomware is designed with strong defense-evasion capabilities, making it particularly dangerous for organizations. The new locker, written in C, is specifically aimed at hypervisor environments, enhancing its impact. The Gentlemen RaaS has built a well-organized affiliate ecosystem, contributing to its swift growth and increasing threat level. As of now, the operation continues to pose a high risk to various sectors worldwide.

Key Points: • Gentlemen RaaS targets Windows, Linux, NAS, BSD, and ESXi systems. • Over 320 victims reported, with more than 240 attacks in early 2026. • The ransomware features strong defense-evasion capabilities and is written in C.