Ransomware That Spreads Itself Changes Containment
The Gentlemen is built to turn one Windows foothold into a network-wide incident. Its value to defenders is not the encryptor alone; the problem is the combination of encryption with self-propagation, which makes “contain the first host and restore from backups” too small for the blast radius.
Microsoft says the Go-based RaaS uses per-file ephemeral Curve25519 keys with XChaCha20, then tries multiple lateral movement methods at once to spread across the environment. Microsoft ties the activity to Storm-2697 affiliates, and says it has already hit organizations across education, transportation, healthcare, and financial sectors in multiple regions.
The forward risk is speed and breadth. By the time encryption is noticed, the attacker may already have moved across weakly segmented Windows networks and doubled the pressure with exfiltration.