The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm

The Gentlemen ransomware operation led by LARVA-368 claims 478 victims since March 2025, leveraging AI for development and hybrid cryptographic encryption.

• •Offers five ransomware versions for Windows, Linux, ESXi, and LVM with 90% affiliate profit-sharing
• •Exploits edge devices (Cisco, Fortinet) for initial access via vulnerable internet-facing services
• •Uses X25519 key exchange and XChaCha20 encryption with --spread enabling worm-like network propagation
• •Employs red team utilities for privilege escalation and lateral movement across networks
• •Leaked communications and exposed toolkits reveal systematic multi-phase attack methodology and CVE exploitation patterns

This summary was automatically generated by AI based on the original article and may not be fully accurate.