(acronis.com) The Gentlemen Ransomware: A Comprehensive Analysis of a Prolific RaaS Operation and Its Sophisticated Tactics In brief - This article analyzes 'The Gentlemen,' a Russian-speaking ransomware-as-a-service (RaaS) group that emerged in 2025 and targets a wide array of global sectors using a double-extortion model. Technically - This article details a Go-based ransomware executable targeting Windows, Linux, NAS, and BSD systems. It employs ChaCha20 encryption combined with Elliptic-curve Diffie–Hellman (KAS-ECC-SSC) for key management, utilizing a chunk-based encryption strategy for files over 1MB to increase speed. The malware ensures persistence via scheduled tasks and registry Run keys, evades detection by disabling Windows Defender and clearing event logs, and utilizes a custom 'EDR killer' that leverages vulnerable kernel drivers (CVE-2025-70795 and Lenovo BootRepair.sys) to terminate security processes via IOCTL requests. Additionally, it features automated lateral movement capabilities using PowerShell and PsExec to propagate across domain-joined workstations. Source: https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/ #Cybersecurity