The Gentlemen Ransomware
- ID
- S9051
- Type
- Malware
- Platforms
- macOS, Linux, Windows, IaaS, ESXi, Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 1 Oct 2026
The Gentlemen Ransomware is a ransomware-as-a-service (RaaS). The Gentlemen Ransomware has been written in Go programming language and has utilized Garble to obfuscate its code to target Windows environments. The Gentlemen Ransomware is capable of executing its’ OS lockers in Windows, Linux, NAS, BSD and ESXi environments. The Gentlemen Ransomware was first observed in mid-2025 as a closed ransomware and shortly later emerged as a RaaS to affiliates in September 2025. The Gentlemen Ransomware has been affiliated with the threat group The Gentlemen.[1][2][3][4]
Techniques used (45)
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1036.004 Masquerade Task or Service
- T1037.003 Network Logon Script
- T1037.004 RC Scripts
- T1047 Windows Management Instrumentation
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.012 Hypervisor CLI
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.007 Clear Network Connection History and Configurations
- T1074.001 Local Data Staging
- T1083 File and Directory Discovery
- T1090 Proxy
- T1106 Native API
- T1112 Modify Registry
- T1135 Network Share Discovery
- T1222.001 Windows Permissions
- T1482 Domain Trust Discovery
- T1484.001 Group Policy Modification
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491.001 Internal Defacement
- T1529 System Shutdown/Reboot
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1561.001 Disk Content Wipe
- T1564.001 Hidden Files and Directories
- T1564.012 File/Path Exclusions
- T1569.002 Service Execution
- T1675 ESXi Administration Command
- T1678 Delay Execution
- T1679 Selective Exclusion
- T1680 Local Storage Discovery
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1686.003 Windows Host Firewall
- T1689 Downgrade Attack
- T1690 Prevent Command History Logging