The Gentlemen RaaS Nets 800+ Victims, Offers 90% Ransom Share
The Gentlemen ransomware‑as‑a‑service has compromised over 800 organizations across the US and Europe and pays affiliates up to 90 % of the ransom, making it one of the most lucrative RaaS platforms seen in 2025. Its aggressive revenue‑share, cross‑platform payloads and active use of EDR‑killing tools amplify the threat to enterprises of all sizes.
Who are the affiliates behind The Gentlemen and how do they earn their share?
Affiliates are typically cyber‑crime operators who purchase or lease the ransomware kit, then deploy it against chosen victims. The Gentlemen’s model promises up to 90 % of collected ransom proceeds to these partners, a split that dwarfs the 60‑70 % range common among older RaaS groups. This generous cut incentivizes a larger pool of attackers, expanding the group’s reach and accelerating victim acquisition, according to the Threat Research Unit’s mid‑2025 briefing.
What techniques does The Gentlemen use to bypass defenses?
The gang relies on a blend of custom droppers and living‑off‑the‑land binaries (LOLBins) that exploit vulnerable drivers. One documented incident employed a malicious dropper that abused the Safetica ProcessMonitor and Lenovo BootRepair.sys drivers, allowing the payload to execute with kernel‑level privileges and evade endpoint detection and response (EDR) solutions. By leveraging these driver vulnerabilities, the ransomware can remain undetected long enough to encrypt critical data.
Why does The Gentlemen target Windows, Linux, NAS, and BSD systems?
Most ransomware families focus on Windows, but The Gentlemen’s cross‑platform variants reflect a strategic shift toward heterogeneous environments. Enterprises increasingly run mixed OS stacks, including Linux servers, network‑attached storage (NAS) appliances, and even BSD‑based systems for specialized workloads. By supporting multiple platforms, the group maximizes ransom potential and forces defenders to broaden their protective measures, a trend highlighted in the researchers’ analysis.
How did a breach of their own infrastructure reveal their operations?
In a rare turn of events, security researchers gained access to The Gentlemen’s command‑and‑control (C2) servers after a misconfiguration exposed internal logs and affiliate credentials. The leak provided unprecedented visibility into the affiliate network, the tooling used for payload delivery, and the financial flows between the gang and its partners. This breach underscored the operational security (OpSec) gaps that even sophisticated ransomware outfits can exhibit.
What can organizations do now to reduce exposure to The Gentlemen?
Effective mitigation starts with hardening the attack surface. Ensure all drivers, especially third‑party ones like Safetica and Lenovo utilities, are patched promptly. Deploy EDR solutions that can monitor kernel‑level activity and flag anomalous driver loading. Conduct regular vulnerability scans of NAS devices and Linux servers, and enforce least‑privilege policies for service accounts. Finally, maintain up‑to‑date offline backups and test restoration procedures to limit ransomware impact.
What this means for you
Businesses of any size should treat The Gentlemen as a high‑priority threat. Their generous affiliate payouts, multi‑OS capabilities, and driver‑level evasion tactics mean that traditional Windows‑only defenses are insufficient. By tightening patch management, expanding EDR coverage, and regularly auditing peripheral devices, you can lower the odds of a successful infection and protect critical data from ransom demands.
Frequently asked questions
How many victims has The Gentlemen ransomware‑as‑a‑service compromised?
The group claims more than 800 victims across the United States and Europe, according to the Threat Research Unit’s 2025 report.
What affiliate revenue share does The Gentlemen offer?
Affiliates can receive up to 90 % of the ransom payment, which is unusually high compared to typical ransomware‑as‑a‑service models.
Which operating systems are targeted by The Gentlemen ransomware?
The ransomware includes variants for Windows, Linux, network‑attached storage (NAS) devices, and BSD systems, expanding its reach across mixed‑environment networks.
How does The Gentlemen bypass endpoint detection tools?
It uses custom droppers that exploit vulnerable drivers such as Safetica ProcessMonitor and Lenovo BootRepair.sys, granting kernel‑level execution that evades many EDR solutions.
What immediate steps should an organization take to defend against this threat?
Patch all drivers, deploy EDR with kernel‑monitoring, scan NAS and Linux assets for vulnerabilities, enforce least‑privilege policies, and maintain verified offline backups.
