New RaaS Operation ‘Gentlemen’s’ Surfaces, Expanding Attacks to Windows, Linux, and ESXi Systems

 

Gentlemen’s” RaaS: a new cross-platform ransomware service advertised on hacking forums

 A new affiliate-style ransomware-as-a-service called Gentlemen’s, promoted by actor zeta88, brings purpose-built lockers for Windows, Linux, ESXi and more — and a generous 90/10 revenue split that could accelerate adoption.

TL;DR

A new Ransomware-as-a-Service (RaaS) named Gentlemen’s has appeared on underground forums. Advertised by a threat actor calling themselves zeta88, the platform combines a lucrative affiliate revenue model with purpose-built, cross-platform lockers (Windows, Linux, NAS, BSD and VMware ESXi). KrakenLabs researchers flagged the campaign after analyzing forum promotions. The malware uses modern crypto (XChaCha20 + Curve25519 with per-file ephemeral keys), sophisticated lateral movement and persistence primitives, and centralized decryption infrastructure — a combination likely designed to scale operations rapidly.

---

What appeared on the forums

Forum posts and promotional materials by zeta88 present Gentlemen’s as a turnkey ransomware operation for affiliates. The offering lowers the barrier to entry for less technical attackers by providing ready-made tooling, operational infrastructure and an enticing revenue split that pays 90% of ransoms to affiliates while the operator retains 10%.

That financial model — highly favorable to affiliates — is a clear recruitment driver within the cybercriminal ecosystem and could lead to rapid, geographically dispersed deployments against enterprise targets.

---

Business model and operational design

Gentlemen’s is built around an affiliate RaaS model and centralized operational control:

• Affiliate split: 90% to affiliates / 10% to operator.

• Centralized decryption: Operator-run infrastructure retains control over decryption keys and negotiation, allowing the operator to manage payments and recovery.

• Purpose-built lockers: Separate binaries for different platforms rather than single generic variants, indicating an investment in platform-specific development and reliability.

This structure both democratizes access to high-end ransomware and preserves the operator’s control over critical components (payment and decryption), enabling rapid scale while maintaining a revenue stream.

---

Technical highlights

KrakenLabs’ analysis of the promotional material and samples shows a deliberately engineered, cross-platform toolkit:

• Platform coverage: Go-based lockers targeting Windows, Linux, NAS and BSD systems; a separate C-coded ESXi locker (~32 KB).

• Encryption: Modern cryptography — XChaCha20 combined with Curve25519; uses per-file ephemeral keys to make decryption more granular and to complicate recovery efforts.

• Self-propagation & lateral movement: Implements propagation and remote execution through native administrative mechanisms, including:

  • WMI / WMIC

  • SCHTASKS

  • sc (Service Control)

  • PowerShell Remoting

• Persistence: Uses scheduled tasks and registry/run-on-boot routines to remain active after reboots and attempted remediation.

• Network compromise: Automated network share discovery and automated encryption of discovered resources to maximize impact across an organization.

The ESXi locker’s small ~32 KB footprint and C implementation indicate a lightweight, targeted approach to compromise virtualization hosts — a high-value target for crippling enterprise environments.

---

Why this is concerning

Several features raise the threat level:

1. Cross-platform scope: Supporting Windows, Linux, NAS, BSD and ESXi means more opportunities to hit critical infrastructure and mixed-server environments.

2. Modern cryptography: Use of XChaCha20 + Curve25519 and per-file ephemeral keys complicates forensic recovery and offline decryption attempts.

3. Effective propagation: Leveraging native admin tools (WMI, SCHTASKS, sc, PowerShell Remoting) allows rapid lateral spread with common administrative privileges.

4. Economic incentives: The 90/10 split drives recruitment and could quickly increase the number of affiliates deploying the malware.

5. Operator control over decryption: Centralized decryption services let the operator monetize every incident while limiting victims’ options.

---

Mitigation and defensive recommendations

(High-level guidance for defenders.)

• Isolate and segment: Strict network segmentation for virtualization hosts (ESXi), NAS, and critical infrastructure reduces blast radius.

• Least privilege: Restrict administrative credentials and monitor for suspicious use of WMI, WMIC, SCHTASKS, sc, and PowerShell Remoting.

• Harden backups: Maintain immutable, offline, or air-gapped backups and regularly test restoration procedures.

• Endpoint visibility: Use EDR/XDR to detect abnormal scheduled task creation, unusual service installs, and mass file encryption behaviors.

• Network share controls: Limit access to network shares and monitor large file-modification patterns or abnormal access spikes.

• Patch & inventory: Keep hypervisor hosts and OSes patched; maintain an up-to-date inventory so high-value assets are known and protected.

• Threat intel & hunting: Monitor underground forums and threat feeds for activity related to Gentlemen’s / zeta88 and hunt for Indicators of Compromise (IoCs).