--- title: The Gentlemen Ransomware Uses 21 Remote Execution... description: A new ransomware strain called 'The Gentlemen' has been identified, written in Go and obfuscated with Garble. It employs up to 21 remote execution techniques —... canonical: https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Gentlemen Ransomware Uses 21 Remote Execution Techniques to Spread Across Networks | daily.dev og:description: A new ransomware strain called 'The Gentlemen' has been identified, written in Go and obfuscated with Garble. It employs up to 21 remote execution techniques —... og:url: https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo og:image: https://api.daily.dev/og/posts/VCjqCXYgO.png og:image:alt: The Gentlemen Ransomware Uses 21 Remote Execution Techniques to Spread Across Networks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Gentlemen Ransomware Uses 21 Remote Execution Techniques to Spread Across Networks **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 4 min read · 0 upvotes · 0 comments ## Summary A new ransomware strain called 'The Gentlemen' has been identified, written in Go and obfuscated with Garble. It employs up to 21 remote execution techniques — including PsExec, scheduled tasks, Windows services, and PowerShell — to self-propagate across networks after compromising a single host. The malware disables Microsoft Defender, wipes forensic logs, deletes Volume Shadow Copies, and removes backup tools before encrypting files using a Curve25519/XChaCha20 hybrid scheme. It has evolved into a ransomware-as-a-service operation with affiliates including penetration testers and initial access brokers. Sectors affected include education, healthcare, transportation, and financial services across multiple continents. Recommended defenses include restricting lateral movement, maintaining offline/immutable backups, and monitoring for propagation indicators like anonymous shares and unexpected PsExec usage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Why The Gentlemen ransomware is a test of identity and recovery controls](https://daily.dev/posts/why-the-gentlemen-ransomware-is-a-test-of-identity-and-recovery-controls-3ttk3rtgg) · CSO Online · 0 upvotes · 0 comments - [The Gentlemen RaaS: rapid growth and a new ransomware variant](https://daily.dev/posts/the-gentlemen-raas-rapid-growth-and-a-new-ransomware-variant-wabrzzwln) · Securelist · 0 upvotes · 0 comments - [The Gentlemen are coming for your files, and then your network](https://daily.dev/posts/the-gentlemen-are-coming-for-your-files-and-then-your-network-74c3dmzky) · CSO Online · 1 upvotes · 0 comments - [Thus Spoke…The Gentlemen](https://daily.dev/posts/thus-spoke-the-gentlemen-lz5mvstlx) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Gentlemen Ransomware Uses 21 Remote Execution Techniques to Spread Across Networks","url":"https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo"},"datePublished":"2026-07-07T10:49:55.031Z","dateModified":"2026-07-07T10:50:22.307Z","description":"A new ransomware strain called 'The Gentlemen' has been identified, written in Go and obfuscated with Garble. It employs up to 21 remote execution techniques —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fe9eeb967de205fd6743e2535f16178?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-gentlemen-ransomware-uses-21-remote-execution-techniques-to-spread-across-networks-vcjqcxygo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang,ransomware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"The Gentlemen Ransomware Uses 21 Remote Execution Techniques to Spread Across Networks"}]} ```