Malware
Gentlemen
According to Cybereason, "The Gentlemen" ransomware is a cross-platform ransomware family with lockers for Windows, Linux, and ESXi, with the analyzed Windows locker implemented as a 64-bit Golang exe
Gentlemen is a Windows malware family operated by The Gentlemen.
Background
Cybereason characterizes "The Gentlemen" as a cross-platform ransomware family shipping lockers for Windows, Linux, and ESXi, with the examined Windows locker compiled as a 64-bit Golang executable. Run as a Ransomware-as-a-Service, it offers adjustable encryption levels built on XChaCha20 and Curve25519 and carries out dual extortion by encrypting and stealing data alike. The malware leans heavily on persistence and automation (self-restart, run-on-boot, registry and autostart entries), interacts broadly with the system through task schedulers, WMI, and remote PowerShell, and performs extensive enumeration of local, network, and clustered storage to broaden its impact. It also incorporates defense evasion and anti-forensics, disabling security products, wiping logs and traces, altering permissions, and shutting down database, backup, remote-access, and virtualization services prior to encryption.
Source: Malpedia (Fraunhofer FKIE).