New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi

Threat intelligence researchers have identified a new ransomware-as-a-service operation dubbed The Gentlemen’s RaaS, actively recruited on underground hacking forums by an operator using the handle zeta88. The cross-platform threat offers dedicated encryption lockers for Windows, Linux, and ESXi, with components coded in Go and C, and represents a notable evolution in ransomware capabilities across enterprise infrastructure.

The operator presents an unusually generous affiliate programme, offering affiliates a 90 percent share of ransom proceeds while retaining a 10 percent operational fee, and granting partners full control over ransom negotiations while the operator handles the technical backend and data hosting.

The framework uses multi-platform propagation, including WMI, WMIC, scheduled tasks (SCHTASKS), service control (SC), and PowerShell remoting to move laterally, with persistence via run-on-boot mechanisms and registry changes. It also features a universal decryptor and a data-leak site to enable double-extortion, while geographic avoidance patterns exclude Russian and CIS regions. Organisations running Windows, Linux, and virtualised environments face elevated risk from this well-resourced platform. 29 October 2025.