The Gentlemen RaaS Turns Infected Hosts Into SMB Distribution Points for Rapid Spread

The Gentlemen ransomware has emerged as a highly aggressive Ransomware-as-a-Service (RaaS) threat that actively transforms infected hosts into Server Message Block (SMB) distribution points for rapid lateral movement.

Written in Go and heavily obfuscated with Garble, this sophisticated malware surfaced in mid-2025 before officially launching its affiliate program in September.

Threat actors deploying this payload primarily target critical infrastructure across the education, healthcare, transportation, and financial sectors worldwide.

What distinguishes this variant from traditional ransomware is its potent worm-like self-propagation engine.

Operators utilize double extortion tactics, exfiltrating sensitive corporate data before encrypting local files to maximize financial pressure on victims.

Gentlemen RaaS Spreads Rapidly

Operators control the encryptor strictly through command-line arguments that require a build-specific password for execution.

If an analyst or automated sandbox attempts to run the binary without the correct password, the malware prints an error and terminates.

This acts as a basic but highly effective anti-analysis technique. As an example, operators use commands like gentlemen.exe –password examplePassword –full –spread “” –wipe to authenticate, encrypt local shares, propagate laterally, and wipe free space.

When executed with system-level privileges, the malware creates a one-time scheduled task to run as SYSTEM. It sets an environment variable to indicate that it is a background encryption worker.

Before initiating the encryption phase, the payload aggressively dismantles host defenses by executing PowerShell commands to turn off Microsoft Defender real-time monitoring and grant full access to the entire C:\ volume.

The encryptor also establishes persistent access by creating startup scheduled tasks and modifying registry Run keys. The ransomware thoroughly disrupts forensic investigations and recovery efforts.

It deletes Volume Shadow Copies using both administrative commands to ensure reliable destruction of local backups. It also clears prefetch files, remote desktop logs, and PowerShell command histories to erase its tracks.

To ensure maximum impact, the malware forcibly terminates processes and services associated with SQL databases, backup agents, and virtualization platforms. This dual-purpose termination both unlocks files for encryption and simultaneously blinds security monitoring tools.

Picussecurity said, the self-propagation module represents the most dangerous component of The Gentlemen ransomware. When the spreading feature is enabled, the malware converts the initially compromised machine into a localized distribution hub.

It copies the malicious binary into a temporary directory. It publishes it over a hidden SMB share configured for anonymous access.

The malware actively enumerates all reachable workstations, servers, and domain controllers to identify new targets.

For each discovered host, it runs a defense-evasion script that turns off the firewall and enables the highly vulnerable legacy SMB1 protocol.

The worm relies heavily on redundancy, attempting up to \(21\) distinct remote execution operations per target.

It leverages tools like PsExec, Windows Management Instrumentation Command-line (WMIC), and PowerShell remoting to ensure successful lateral movement.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.