Sophisticated “The Gentlemen” Ransomware RaaS Emerges with XChaCha20 Encryption and 48 Victims in 3 Months

Cybereason’s Threat Intelligence Team published an in-depth look at a rapidly evolving ransomware group known as “The Gentlemen”, which surfaced in mid-2025 and has quickly become one of the most technically sophisticated threats seen this year. According to the report, the group operates a dual-extortion model, encrypting sensitive files while exfiltrating business data and threatening to publish it on dark web leak sites unless a ransom is paid.

By the fall of 2025, Cybereason notes the operators had published 48 victims, an unusually aggressive pace for a newly formed ransomware organisation. The analysis shows The Gentlemen began by testing affiliate models before creating their own RaaS platform, with experts saying they employed a Go-based Windows variant and a robust feature set that includes XChaCha20 encryption and Curve25519.

Key enhancements span persistence, automation, and stealth across Windows, Linux, and ESXi, including automatic self-restart, silent execution, and dual-mode encryption capable of targeting local disks and network shares.

Cybereason also highlights aggressive network propagation, WMI and PowerShell remoting use, and strong affiliate support, with negotiations and access to specialised tools for trusted partners. according to Cybereason: “The Gentlemen ransomware combines advanced encryption techniques with dynamic propagation options… continuously updated to adapt to new defence strategies.”