[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) is a ransomware-as-a-service (RaaS). [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has been written in Go programming language and has utilized Garble to obfuscate its code to target Windows environments. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) is capable of executing its’ OS lockers in Windows, Linux, NAS, BSD and ESXi environments. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) was first observed in mid-2025 as a closed ransomware and shortly later emerged as a RaaS to affiliates in September 2025. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has been affiliated with the threat group [The Gentlemen](https://attack.mitre.org/groups/G1058).(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)
Platforms: macOS, Linux, Windows, IaaS, ESXi, Network Devices
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.