The Gentlemen, a group of new ransomware, heavy rampage.

"The Gentlemen," a new ransomware group, has been on a heavy rampage since mid-2025, stealing important data before logging, hitting more than 17 countries around the world.

Gentlemen or gentlemen, when you see this word, you may think of a modest, good-looking man with a genus, but if you turn it into a malware name, especially Ransomware, there is no way for the victim to be polite.

According to a report by the website, Cyberpress has mentioned the detection of a new ransomware spread campaign called Gentlemen, which was developed by the ransomware group of the same name. The malware has been spreading since last August and has spread to 17 countries around the world, covering countries in the Asia-Pacific, North America, South America and the Middle East. The attack has focused on important and high-value business groups such as manufacturing groups, construction groups, medical business groups, and insurance business groups, focusing on medium and large businesses. The model of operations shows that the ransomware group is Highly proficient and professional.

Technically, the Gentlemen ransomware is built with the Go language. It collects a variety of techniques for invading the victim's system on a single malware. After the malware is embedded on the victim's system, before encrypting the files on the victim's machine to secure them. The malware will shut down the Windows Defender, shut down the Backup Service, such as Veeam, stop Databases such as MSSQL and MongoDB, and delete the Sytem Log to cause post-damage analysis to occur. Even harder to do.

The malware will run under specified environment images. It will run within the Password (-password) parameter. If the password is not used correctly, the malware will stop immediately. This prevents accidental operation and prevents being monitored by the malware research team. In addition, the malware also runs Argument on Command-Line to help determine the scope of operation, the desired file target, and the speed of encryption of the file. It increases the performance and flexibility of such malware, such as -system, -shares, -fast, and -ultrafast, etc.

As part of the file encryption technique, this ransomware uses a hybrid X25519 (ECDH) and XChaCha20 encryption technique in which each encrypted file has a unique key (Unique Key) and a nonce key, which is encrypted with a non-static format, or Dynamic, to increase the difficulty of trying to decrypt the unlock of the file without relying on the private key or Private Key stored with hackers using such ransomware. Files of 1 MB or smaller are fully encrypted, while larger files are encrypted only in parts of the file simply by guaranteeing that the file will be used. No. To help file encryption more quickly than full-file encryption.

After the ransomware has completed the encryption of the file lock on the machine, the malware will release a ransom note under the file name README-GENTLEMEN.txt. It will tell which folders are the victims, along with the words that all files have been sent to hackers, and will release them to the public immediately if the ransom is not paid at the specified time. It is proposed that two files will be unlocked to confirm that hackers can unlock the file. At the same time, the malware will change the background (Wallpaper) to intimidate the victim.

A research team from AhnLab, an expert in the development of cyber tools that detect ransomware, has identified ransomware under the name Ransomware / Win GentlemenCrypt and updated the AhnLab V3 detection tool during the month of December to detect it as well as provide malware identification in the MD5 Hash format. The malware file identifier looks like this.

adf675ffc1acb357f2d9f1a94e016f52 and de1a114a2c5552387a1bbb61501bf129

# Welcome 2026 # Take care of yourself # Open budget # Includes IT matters # Trending