Self‑Propagating Go Ransomware “The Gentlemen” Encrypts Networks Across Multiple Sectors
What Happened — The Gentlemen ransomware, written in Go and linked to Storm‑2697 affiliates, employs a per‑file ephemeral AES‑256 key encryption scheme and a self‑propagation module that spreads laterally across a victim’s network in parallel, encrypting data on hundreds of endpoints within minutes.
Why It Matters for TPRM —
- Self‑propagation magnifies the impact of any compromised third‑party, turning a single foothold into a full‑network outage.
- Go‑based binaries often bypass traditional signature‑based defenses, raising detection challenges for vendors.
- Lateral movement leverages trusted internal protocols (SMB, WMI, PowerShell Remoting), exposing supply‑chain and privileged‑access weaknesses.
Who Is Affected — Enterprises in finance, healthcare, manufacturing, SaaS, and any organization with Windows‑based endpoints and shared file systems.
Recommended Actions —
- Conduct a least‑privilege review of all third‑party access and enforce strict network segmentation.
- Verify that vendors use behavior‑based detection capable of identifying unknown Go binaries.
- Patch and harden Windows remote execution services (SMB, WMI, PowerShell Remoting) and monitor for anomalous lateral movement.
Technical Notes — The ransomware generates a unique encryption key per file, encrypts with AES‑256, then discards the key, rendering recovery impossible without backups. Propagation occurs via simultaneous SMB, WMI, and PowerShell Remoting sessions, without requiring stolen credentials. No specific CVE is referenced; the technique exploits built‑in Windows remote execution features. Source: Microsoft Security Blog