The Gentlemen is a Go-based file encryptor, packed with VMProtect, that surfaced in July 2025. Locked files keep their original name and gain a short random suffix chosen for each victim, while every affected folder receives README-GENTLEMEN.txt. That text opens by addressing the reader as Gentlemen, says the network is under the attackers' control, and directs them to a Tox ID and an onion blog with an hour countdown. The desktop background is also replaced. Activity is aimed at company networks across manufacturing, construction, healthcare, insurance, education and finance, with victims in Asia-Pacific and the United States. Before encrypting it stops services, wipes shadow copies and clears event and RDP logs. The operators claim to steal NAS and cloud data and publish victims on a leak site, so stolen data should be assumed. No code lineage to an earlier family has been established.
Ransom note filenames: README-GENTLEMEN.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161