Researchers mapped how the ransomware tries 21 different ways to run itself on every reachable machine once a single device is compromised, treating that device as a launching pad rather than a final target.

 

What happened

Researchers have published a detailed breakdown of how The Gentlemen ransomware operates from initial infection through network-wide encryption, documenting a self-spreading feature that turns a single compromised device into a distribution point for the rest of the network. According to CyberSecurityNews, the malware is written in the Go programming language and disguised using an obfuscation tool called Garble, first appearing in mid-2025 before evolving into a full ransomware-as-a-service operation with its own affiliate program. Rather than simply encrypting the device it first infects, the malware actively scans the surrounding network for other reachable computers and attempts to spread to each one it finds. Researchers reported the group's attacks have reached organizations across education, transportation, healthcare, and financial services on nearly every continent. The group has also partnered with the BreachForums cybercrime community to recruit affiliates, including penetration testers and initial access brokers, a move likely to widen the pool of criminals using the tool.

 

Going deeper

The self-propagation behavior is triggered by a specific command-line option researchers identified as the spread flag. Once activated, the infected machine copies its own installer file into a shared folder configured for open, unauthenticated access, effectively turning that device into a distribution hub for the rest of the network. The malware then pulls in PsExec, a legitimate Windows administration tool, either from a local copy or by downloading it, and begins scanning for reachable machines, including ordinary workstations, servers, and domain controllers. Against each discovered target, the malware first runs a script that weakens that machine's defenses, disabling security monitoring, turning off firewall protection, and re-enabling an outdated, insecure version of the Windows file sharing protocol. Only after clearing that path does it attempt to run the ransomware payload itself, trying as many as 21 separate methods on each target, including remote file copying, PsExec, scheduled tasks, Windows services, and PowerShell-based techniques. Because the attackers only need one of those 21 methods to succeed on any given machine, the malware has significant built-in redundancy for continuing to spread even when some methods are blocked.

 

What was said

Microsoft, which tracks this activity under a separate internal name, stated in reporting cited by The Hacker News that "when enabled with the spread argument, it turns the malware from a single-host encryptor into a self-propagating worm that attempts to deploy its encryptor to every reachable system on the network." Microsoft added that a separate wipe option triggers an additional post-encryption routine designed to eliminate recoverable artifacts from the disk after the attack completes, making recovery efforts significantly harder even for organizations that maintain some backup capability.

 

In the know

The Gentlemen's technical evolution has been documented across multiple research efforts throughout 2026. According to BleepingComputer, the group also maintains a standardized suite of tools specifically built to disable endpoint detection and response software before deployment, a capability the group centralizes and hands directly to affiliates rather than leaving each affiliate to source their own evasion tools. That combination, centralized defense evasion tooling paired with a self-propagating worm engine, has helped the group claim more than 500 victims since emerging in 2025, with recent quarterly data placing it among the most active ransomware operations tracked.

 

The big picture

A ransomware strain that spreads itself across a network the moment it lands on a single device changes the calculation for how quickly an organization needs to respond to any individual compromised endpoint. A traditional ransomware infection gives defenders time between initial compromise and full deployment to isolate the affected machine. Self-propagating malware that actively hunts for new targets and tries 21 different ways to infect each one compresses that window significantly, particularly in healthcare environments where clinical workstations, administrative systems, and connected medical devices often share the same network segments. According to Paubox's 2026 Healthcare Email Security Report, only 5 percent of known phishing attacks, the most common entry point for ransomware, are reported by employees to security teams, meaning the single infected device that triggers a network-wide spread is often the one nobody flagged in the first place.

 

FAQs

What does self-propagating mean, and how is it different from typical ransomware behavior?

Most ransomware encrypts only the device it directly infects, relying on the attacker to manually move to additional systems if they want to spread further. Self-propagating ransomware automates the spreading process, actively scanning for other reachable machines and attempting to infect each one without requiring further action from the attacker once the initial infection begins.

 

Why does the malware weaken a target's defenses before attempting to run the ransomware payload?

Disabling security monitoring, turning off firewall protection, and re-enabling an outdated file-sharing protocol on each target machine clears obstacles that would otherwise block or flag the ransomware payload from running successfully. By preparing each target this way before the actual infection attempt, the malware increases its odds of successfully spreading to every reachable device.

 

Why does trying 21 different methods on each target matter for defenders?

Security tools that block one specific technique, such as PsExec usage, do not stop the malware from succeeding through a different method, like scheduled tasks or PowerShell. Defenders need to account for and monitor all 21 documented techniques rather than assuming that blocking a single common method is sufficient protection.

 

What makes the encryption used by this ransomware particularly difficult to reverse without paying?

The malware generates a unique encryption key for every single file it encrypts, using a combination of elliptic curve cryptography and a modern stream cipher. Because each file has its own distinct key rather than sharing one key across the entire infection, recovering files without the attacker's private key is not practically feasible even with significant computing resources.

 

What steps can organizations take to limit the impact if one device becomes infected?

Network segmentation that limits which systems a single compromised device can reach directly reduces how far the self-propagation feature can spread before hitting a boundary. Maintaining offline, disconnected backups protects against the malware's post-encryption cleanup routine, and monitoring specifically for the network scanning, PsExec usage, and defense-weakening commands described in this research provides an earlier detection opportunity than waiting for encryption to begin.