Emerging Gentlemen Ransomware Hits 17 Countries with Double Extortion & BYOVD Evasion Tactics

A new ransomware operator, dubbed Gentlemen, has rapidly risen in prominence, targeting industries across 17 countries with double extortion and BYOVD evasion tactics, according to AhnLab. The group was first identified in August 2025 and has since become one of the year’s most active emerging threats, using high-level intrusion techniques to breach networks, steal data, and encrypt critical systems.

The report notes that during breaches the group employs tactic common to advanced ransomware operations, such as Group Policy Objects manipulation and Bring Your Own Vulnerable Driver (BYOVD). BYOVD attacks deploy a legitimate but vulnerable driver to bypass security software, signalling a high level of technical competency, with internal propagation procedures that allow rapid spread once inside.

Victims span manufacturing, construction, healthcare and insurance sectors across APAC, North America, South America and the Middle East, underscoring a broad, opportunistic reach. The group’s ransom notes threaten an “irreversible wipe of all data” and publication of exfiltrated secrets on their leak site, and claim that law enforcement and third-party recovery firms are useless, insisting “Only we can decrypt your data.”