Gentlemen Ransomware Spreads Before It Encrypts — That's the Whole Point
Microsoft's analysis of the Go-based Gentlemen encryptor shows why lateral movement, not file-locking, is now the primary design goal of serious ransomware operations.
Ransomware has always been about speed. Gentlemen, a Go-based encryptor first observed in mid-2025, makes that priority structural.
Microsoft's technical breakdown describes a self-propagating locker that identifies reachable systems, authenticates with harvested credentials, and copies itself to remote machines over SMB — all without requiring an operator to stay glued to a keyboard. That last part matters. Automation means the blast radius expands during the window between initial compromise and detection, which is exactly when defenders are blind.
The malware accepts command-line arguments to control behavior. Execution requires a password validated against a hardcoded value in the binary — for the analyzed sample, that value was 9VoAvR7G. Operators can then tune scope, encryption speed, lateral movement, and post-encryption actions. The --full flag spins up separate processes to hit local drives under SYSTEM privileges and any network shares visible to the infected account. The --spread flag handles propagation. It's modular ransomware-as-a-product, not a blunt instrument.
Gentlemen launched as a closed operation, flipped to ransomware-as-a-service in September 2025, and subsequently recruited affiliates — including pen-testers and initial access brokers — through BreachForums. Microsoft reports active targeting across education, healthcare, transportation, and financial sectors in North America, South America, Europe, Africa, and Asia.
The RaaS password mechanic doubles as a licensing control. It prevents affiliates from running the binary without authorization and blocks casual binary recovery by researchers or defenders. Clean, if cynical.
AttackIQ's Paul Reid frames the threat correctly: "Modern ransomware is no longer just about encrypting files. The bigger risk is how quickly a single compromised machine can become a broader business disruption." That framing should shape how defenders prioritize their tooling. Watching for encryption events is table stakes — by then, the spread has likely already happened.
Microsoft's guidance points at lateral movement telemetry, credential reuse patterns, and remote execution attempts as the earlier signals worth monitoring. That's standard network-defense thinking, but it bears repeating: the detection window here shrinks actively as the malware runs, not passively as time passes.
For organizations still waiting on a help desk ticket to flag something wrong, Gentlemen's design is a direct argument for why that model fails.
