The Gentlemen Ransomware Decryption & Data Recovery

The Gentlemen was first documented around July 2025. Unit 42 traces its core operators to ArmCorp, an affiliate crew of the Qilin RaaS; the programme opened public affiliate recruitment in September 2025 with a 90/10 revenue split against a market norm of 70-80%. Microsoft tracks the operators as Storm-2697, the Sophos counter threat unit as GOLD SHERWOOD.

Growth has been steep. Sophos counted fewer than 20 leak-site victims per month through late 2025, an average above 75 by early 2026 and a record 169 in July 2026, for 683 names between September 2025 and July 2026; Unit 42 separately recorded roughly 580 claimed victims across 77 countries as of early July 2026 and ranked the group the second most active RaaS programme behind Qilin. By sector, manufacturing was the largest slice of Unit 42's 580 (103 victims), while Sophos stresses a wide spread of industries and affiliates picking targets from whatever access they hold. Kaspersky telemetry places Brazil, China, Indonesia, Taiwan and Thailand among the more heavily hit regions.

On 4 May 2026 the administrator admitted that the group's own backend, "Rocket", had been compromised and internal data leaked; Check Point used it to publish the roles of roughly nine core members and their tooling. The crew kept operating afterwards. For enterprises in China the risk is not whether they are singled out, but how ordinary the entry points are: VPN without MFA, unpatched internet-facing firewalls, and directly reachable hypervisor management interfaces.

Extension. A six-character lowercase alphanumeric suffix is appended to the original filename - Sophos describes it as a "six-character extension", and the Go build Microsoft analysed used .umc16h. The base name is untouched, so order.xlsx becomes order.xlsx.umc16h. Public reporting does not establish whether the suffix is regenerated per build, so a different six-character suffix does not rule the family out - attribution has to come from the note.

Ransom note. README-GENTLEMEN.txt is dropped in every directory the encryptor finishes. The English text claims full control of the network, asserts that only the attackers' key can restore files, and gives a victim ID, a Tox ID and a publication deadline. The C-based variant Kaspersky disclosed in June 2026 uses a .txt filename that spells READ-ME and GEN-TLE-MEN in hyphenated segments (confirm the exact punctuation against the actual sample) and switches to email contact.

Other indicators. The Go encryptor is obfuscated with Garble and needs an 8-byte password argument to run, so executing the sample alone does nothing (sandbox evasion); the System, Application and Security event logs are cleared with wevtutil, shadow copies are deleted with vssadmin and wmic, and takeown, icacls and attrib reassign ownership and attributes. Domain environments show distribution via the NETLOGON share alongside PsExec and WMI execution; staged hosts commonly carry Advanced IP Scanner, Rclone, Restic, the SystemBC proxy and a Cloudflared tunnel installed as a Windows service.

Bottom line. The note plus a six-character extension attributes the family. Whether the build is Go or C and which encryption ratio was used comes only from analysing three to five real encrypted files and the original note - and that determines what recovery options remain.

Sophos measured a median of roughly two days from initial compromise to encryption, with some incidents under 24 hours.

Initial access

• Edge device vulnerabilities. Unit 42 records exploitation of CVE-2024-55591 in FortiOS/FortiProxy, CVE-2025-32433 in Erlang/OTP SSH, CVE-2025-33073 (Windows SMB client NTLM reflection) and CVE-2025-55182, plus suspected zero-day use.
• Credential-based entry. VPN accounts without MFA - Sophos states plainly that "absence of MFA enabled the actor to gain access" - along with leaked or stolen credentials and access bought from initial access brokers.
• Brute force and phishing. Credential brute forcing and spraying, and phishing delivery.

Internal spread. Microsoft found the Go encryptor carries its own self-propagation logic, attempting up to 21 lateral execution techniques per host - PsExec, WMIC, scheduled tasks, Windows services, PowerShell remoting, WMI - needing only one to succeed. Sophos additionally documents domain-wide distribution through NETLOGON shares, which is why domain-wide encryption overnight is the expected outcome.

Privilege and defence evasion. Mimikatz supplies credentials, and the in-house GentleKiller framework loads a vulnerable driver - Unit 42 names ThrottleStop.sys, CVE-2025-7771 - to reach kernel privilege and terminate security processes. Persistence relies on a custom Go backdoor, SystemBC, a Cloudflared tunnel installed as a Windows service, and scheduled tasks named gentlemen*.

Exfiltration and backup destruction. Rclone and Restic handle exfiltration. Before detonation the operators systematically disable Veeam, Backup Exec and SQL Writer services; Sophos catalogued over 200 command variations for this. Missing backups are usually not collateral damage from encryption - they are a deliberate prior step.

Algorithms. The Go encryptor generates an ephemeral Curve25519 (X25519) key pair per file, derives a shared secret against an embedded attacker public key, encrypts content with XChaCha20 and writes the ephemeral public key into the file footer. The private key is discarded after use and never touches disk, so there is no master key to attack offline. The C-based variant Kaspersky disclosed in June 2026 uses AES-256-GCM with RSA wrapping instead.

Partial encryption - the decisive factor in any recovery assessment. Files under 1 MB are encrypted in full. Larger files have chunks encrypted at three distributed offsets, at a ratio set by command-line flags: Microsoft puts the range at roughly 0.9% to 27%, and Kaspersky records --fast at about 9%, --superfast at 3% and --ultrafast at about 1%, with the default (around 27%) applying when no flag is passed. Large database files, virtual disks and mail stores therefore often retain substantial untouched data - but how much survives and how much can be repaired are different questions, turning on whether headers, page directories and partition structures fell inside an encrypted chunk.

Destructive actions. Around 30 processes (virtualisation, databases, backup software, EDR, SAP, Office, mail, browsers, remote access) are killed and some 50 services stopped to release file locks; takeown, icacls and attrib reassign ownership and attributes; shadow copies are deleted and event logs cleared.

Virtualisation and storage. The Go build Microsoft analysed targets Windows only; Kaspersky separately documents a C-based Linux/ESXi locker. In ESXi environments the encrypted objects are typically the flat disk files such as vmdk. Whether VMs were shut down first and which datastores were covered has to be established from on-site artefacts rather than assumed.

Double extortion. Data is stolen before encryption; non-payment leads to staged publication on the Tor leak site.