Gentlemen ransomware compromises corporate networks to intercept and encrypt sensitive data

Gentlemen ransomware , first detected in August 2025, has quickly become a serious threat to corporate networks worldwide.

See also: VolkLocker ransomware allows free decryption

Following a double extortion, the group steals sensitive data before encrypting it, thus maintaining the ability to exert pressure even when backups are available.

The malware has been developed in the Go, which allows it to run efficiently on multiple platforms and perform consistently in different corporate environments.

See also: CyberVolk's new VolkLocker ransomware targets Linux and Windows

Attackers are leveraging advanced techniques, such as Group Policy Objects (GPO) and Bring Your Own Vulnerable Driver (BYOVD)to gain access to systems. Through these practices, they can disable security mechanisms and spread internally within the network.

According to reports, the ransomware has already hit organizations in at least 17 countries, affecting a wide range of industries, such as healthcare, manufacturing, and insurance services.

ASEC analysts point out that Gentlemen has emerged as one of the most active emerging ransomware groups in 2025, thanks to its highly sophisticated distribution methods.

See also: Storm-0249: Escalating ransomware attacks with ClickFix and DLL Sideloading

The group appears to be primarily targeting medium and large organizations, leveraging evasion techniques to bypass standard security monitoring systems. Its rapid spread to regions such as North America, South America , and the Middle East underscores the imperative for continuous and enhanced network surveillance.