Gentlemen ransomware is a sophisticated cross-platform threat that encrypts files on Windows, Linux, and ESXi systems while simultaneously stealing your data for double extortion. Written in the Golang programming language and operated as a Ransomware-as-a-Service (RaaS), this malware represents a professional criminal operation that sells access to affiliates who then deploy it against businesses and individuals. Unlike simpler file encryptors, Gentlemen employs military-grade encryption (XChaCha20 with Curve25519 key exchange), aggressive persistence mechanisms, and automated spreading capabilities that can traverse network shares and connected systems.
Threat Profile
| Threat Name | Gentlemen |
|---|---|
| Classification | Ransomware (Double Extortion) |
| Platform | Windows (64-bit), Linux, ESXi |
| File Type | Windows PE executable (Golang compiled) |
| Distribution Model | Ransomware-as-a-Service (RaaS) |
| Encryption Method | XChaCha20 symmetric encryption with Curve25519 elliptic-curve key exchange |
| Data Exfiltration | Yes—steals files before encryption for dual-extortion leverage |
| Persistence Mechanisms | Registry Run keys, Windows Task Scheduler, autostart folders, self-restart on termination |
| Network Capabilities | Lateral movement via WMI, remote PowerShell, SMB share enumeration |
| First Observed | 2024 (exact date varies by campaign) |
| Last Updated (Malpedia) | September 22, 2026 |
| Severity Assessment | Critical—targets business networks with automated propagation and dual extortion |
How It Spreads
Gentlemen ransomware primarily spreads through affiliate networks that purchase access to the malware from its operators. Unlike mass-distribution threats, this is a targeted operation where criminals choose their victims deliberately—often businesses with valuable data or critical infrastructure dependencies. The initial infection vector varies by affiliate, but common entry points include compromised Remote Desktop Protocol (RDP) credentials, phishing emails with malicious attachments, and exploitation of unpatched vulnerabilities in internet-facing services.
Once inside a network, Gentlemen doesn't stay localized to a single machine. The malware actively enumerates network shares, queries Windows Management Instrumentation (WMI) for connected systems, and uses remote PowerShell sessions to spread laterally. This automated propagation means that infection of one workstation can quickly cascade across an entire office network, encrypting file servers, backup systems, and every connected endpoint before IT staff realize what's happening.
Distribution methods observed in the wild include:
- Compromised RDP access: Attackers purchase stolen credentials from dark web markets or brute-force weak passwords on internet-exposed Remote Desktop services
- Phishing campaigns: Targeted emails with macro-enabled Office documents or ZIP archives containing the Golang executable disguised as legitimate software
- Exploit kits: Automated exploitation of known vulnerabilities in VPN appliances, web servers, or other perimeter devices
- Software supply chain: Compromised installers for legitimate applications, sometimes distributed through fake download sites
- Network propagation: Autonomous spreading from an initial foothold using SMB shares, WMI, and PowerShell remoting
- Insider threats: In some cases, disgruntled employees or contractors with legitimate access deploy the malware intentionally
What It Does On Your Machine
Upon execution, Gentlemen immediately establishes multiple persistence mechanisms to survive system reboots and removal attempts. The malware copies itself to system directories, creates Windows Registry entries under Run keys, schedules tasks through the Windows Task Scheduler, and drops copies in autostart folders. If you terminate the process manually, these persistence hooks will typically restart it within seconds or upon the next system boot—a design choice that makes casual removal attempts futile.
Before encrypting anything, Gentlemen conducts data exfiltration—the "dual extortion" component that makes this threat particularly dangerous. The malware scans for documents, spreadsheets, databases, source code, and other high-value files, then uploads them to attacker-controlled servers. This stolen data becomes leverage: even if you restore from backups, the criminals threaten to publish your sensitive information unless you pay. For businesses, this can mean exposure of customer records, financial data, trade secrets, or regulated information that triggers mandatory breach notifications and regulatory penalties.
The encryption phase uses XChaCha20, a modern symmetric cipher that's effectively unbreakable without the decryption key. Gentlemen generates a unique key for each session using Curve25519 elliptic-curve cryptography, then encrypts files with configurable selectivity—some variants encrypt entire drives, while others target specific file extensions to maximize damage while maintaining speed. Encrypted files typically receive a distinctive extension (varies by campaign), and a ransom note appears on the desktop, in every encrypted folder, and sometimes as wallpaper replacement.
The malware also sabotages recovery options by deleting Windows Volume Shadow Copies (the restore points that would allow you to roll back file changes) and may attempt to disable antivirus software through registry manipulation or service termination. Some variants target backup applications specifically, terminating processes for Veeam, Acronis, and other enterprise backup solutions before encryption begins. This scorched-earth approach aims to eliminate all local recovery paths, forcing victims toward the ransom payment as their only perceived option.
Manual Removal — Step by Step
Isolate the Infected System Immediately
Disconnect all network cables and disable Wi-Fi. If the machine is part of a business network, notify your IT department before proceeding—Gentlemen may have already spread to other systems. Do not reconnect to any network until you're certain the malware is completely removed and you've changed all network passwords from a clean machine.
Boot Into Safe Mode With Networking
Restart the computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking." This loads only essential drivers and services, which may prevent Gentlemen's persistence mechanisms from executing automatically. If the malware has modified boot settings to prevent Safe Mode access, you may need to boot from external media—consider bringing the machine to our shop at this point.
Document Everything Before Making Changes
Take photos of any ransom notes displayed. Note which files have been encrypted and their new extensions. Check the Windows Event Viewer (eventvwr.msc) for unusual activity timestamps. This documentation may be valuable for law enforcement reporting and insurance claims. Do not delete ransom notes—they sometimes contain information needed for potential decryption if law enforcement recovers keys from the criminal infrastructure.
Run Malwarebytes and Kaspersky TDSSKiller
Download Malwarebytes (from a clean computer, transfer via USB) and run a full system scan. Gentlemen's Golang compilation sometimes evades signature detection, so also use Kaspersky's TDSSKiller for rootkit-level persistence. Allow both tools to quarantine all threats. Restart in Safe Mode again after cleaning, then run another scan to confirm removal. Be aware that removing the encryption component does not decrypt your files—that requires either backups or specialized decryption tools (which may not exist for this variant).
Manually Remove Registry Persistence
Open Registry Editor (regedit.exe) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for unfamiliar entries with random names or paths pointing to %TEMP%, %APPDATA%, or C:\ProgramData. Delete suspicious entries, but photograph them first in case you need to restore legitimate software. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce for one-time execution hooks.
Remove Scheduled Tasks and Startup Items
Open Task Scheduler (taskschd.msc) and examine the Task Scheduler Library. Delete any tasks created around the infection timeframe or pointing to suspicious executables. Then open msconfig.exe, go to the Startup tab (or Startup folder in Task Manager on Windows 10/11), and disable any unknown startup items. Check the physical Startup folder at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ for executable files that don't belong.
Search and Delete Malware Executables
Use Windows Search to find recently created .exe files in %TEMP%, %APPDATA%, and C:\ProgramData. Gentlemen often uses random names, but file creation dates will cluster around your infection timeframe. Delete these files. Also search for any .bat or .ps1 scripts created recently, as Gentlemen sometimes drops batch files or PowerShell scripts for persistence. Empty the Recycle Bin when finished.
Restore Files From Backup (Not From Shadow Copies)
If you have external backups created before the infection, restore your files from those. Do not rely on Volume Shadow Copies—Gentlemen specifically deletes these. Verify that your backup media is not infected by scanning it with updated antivirus before restoring. If you lack backups, research whether decryption tools exist for this specific Gentlemen variant at NoMoreRansom.org, but understand that XChaCha20 encryption is mathematically unbreakable without the key.
Change All Passwords From a Clean Machine
Assume that any passwords stored on the infected machine are compromised. From a verified clean computer, change passwords for email accounts, banking, business systems, and especially any RDP or VPN credentials that may have been the initial entry vector. Enable two-factor authentication wherever possible. If this was a business infection, rotate all service accounts and domain credentials.
Monitor Network for Lateral Spread
Even after cleaning one machine, Gentlemen may have established footholds on other network systems. Check all computers, servers, and network-attached storage for encrypted files or suspicious processes. Review firewall logs for unusual outbound connections. If you're not equipped to conduct this investigation, professional incident response is essential—ransomware cleanup is not complete until you've confirmed the malware hasn't spread or persisted elsewhere on your network.
Prevention
- Implement comprehensive offline backups: Maintain at least one backup copy on media that's physically disconnected from your network (not just a separate drive, but removed entirely). Test restoration procedures quarterly to ensure backups actually work when needed. The 3-2-1 rule applies: three copies of data, on two different media types, with one copy offsite.
- Disable or secure RDP access: If Remote Desktop Protocol is not essential, disable it completely. If required, use a VPN for access, implement account lockout policies after failed login attempts, require complex passwords or certificate-based authentication, and change the default RDP port (3389) to reduce automated scanning hits.
- Deploy network segmentation: Separate critical systems (file servers, databases, backups) onto network segments that workstations cannot directly access. Use firewalls or VLANs to restrict lateral movement. This containment strategy won't prevent infection but limits the blast radius when one machine is compromised.
- Maintain rigorous patch management: Subscribe to security bulletins for all software in your environment and apply patches within days of release, not weeks or months. Prioritize internet-facing services (VPNs, web servers, email gateways) and common exploitation targets (Microsoft Office, Adobe products, web browsers). Enable automatic updates for operating systems and applications that support it.
- Train users to recognize phishing: Conduct regular training on identifying suspicious emails—awkward language, urgency tactics, unexpected attachments, links that don't match the claimed destination. Implement email filtering that quarantines messages with executable attachments. Establish a policy where employees verify unexpected requests (especially financial transactions) through a secondary communication channel before complying.
- Use endpoint detection and response (EDR) tools: Consumer antivirus is insufficient against sophisticated ransomware. EDR solutions monitor behavioral patterns—process creation chains, registry modifications, network connections—and can detect malicious activity even when signatures don't match. For businesses, this is not optional; for home users with valuable data, it's worth considering.
- Restrict administrative privileges: Users (including yourself) should operate with standard accounts for daily tasks, elevating to administrator only when installing software or changing system settings. Gentlemen's persistence mechanisms often require administrative rights, so this simple measure can prevent full infection from phishing or drive-by downloads.
- Implement application whitelisting: On critical systems, configure Windows AppLocker or third-party solutions to allow only approved executables to run. This blocks Gentlemen and similar threats from executing even if they reach the system. While challenging to maintain, it's the most effective defense against unknown malware for high-value targets.
Bring It In
Gentlemen ransomware represents the professionalization of cybercrime—a well-engineered product sold to affiliates who deploy it for maximum financial damage. Manual removal is technically possible for experienced users following the steps above, but the data encryption component is permanent without proper backups. If you're reading this article because your files are already encrypted, we need to have an honest conversation: the encryption is unbreakable, and paying the ransom (which we never recommend) doesn't guarantee decryption—criminals frequently take payment and disappear, or provide faulty decryption tools that corrupt files further.
Computer Repair Roswell has handled dozens of ransomware cases, including several Gentlemen infections. We'll assess what recovery options exist—whether you have restorable backups, whether decryption tools have been released, whether the malware is fully removed or still lurking in persistence mechanisms. We'll also help you understand what data was likely exfiltrated and what notification obligations you might have if customer or employee information was stolen. Call us at (770) 954-6025 or bring your machine to our Roswell location. We're located at [shop address], open Monday through Saturday, and we understand that ransomware infections constitute genuine emergencies—we'll prioritize your case accordingly.