Incident response · The Gentlemen ransomware
Hit by The Gentlemen? Leave the encrypted files exactly where they are.
The Gentlemen first appeared in August 2025 and was one of the busiest ransomware operations in the world by mid-2026. In Australia it has listed two food producers, a commercial printer, an apparel company, an IT services firm, an office technology supplier and a financial services business. It shuts down your security tools before it encrypts anything. Its faster modes then lock only a small share of each file, and the rest of the file is where a recovery starts.
Recognise it
How to confirm it is The Gentlemen.
Before anything else, keep the encrypted files and every ransom note exactly where they are. They identify the strain, and they are often the raw material a recovery works from.
- Ransom note
- README-GENTLEMEN.txt in the affected folders. The note points to a Tor negotiation page and a leak-site listing
- File extension
- Six random characters appended to each encrypted file, with the string varying from one victim to the next (published samples include .fjuuk0). An unfamiliar six-character extension next to that note is the giveaway
- First seen
- August 2025, documented by Trend Micro. It is run as ransomware-as-a-service, reportedly offering affiliates 90 percent of each ransom, which has helped it recruit quickly
- Typical entry
- FortiGate firewalls and VPNs, through unpatched management interfaces or stolen credentials. ESET found that victims are picked largely on how their FortiGate is configured. Access bought from brokers is also used
Behaviour
What The Gentlemen does to your systems.
Security tools go first
ESET documented GentleKiller, an EDR killer that loads a vulnerable driver to gain kernel access and then stops more than 400 processes from around 48 security products, Microsoft Defender, CrowdStrike and SentinelOne among them. If your endpoint agents went quiet before the encryption, this is why.
Spread by Group Policy
Trend Micro saw operators use the domain's own Group Policy tools to push the encryptor to every machine at once, after mapping the network with Advanced IP Scanner. PsExec covered the gaps. Assume the attacker held domain admin.
Encryption depth is a flag
The affiliate picks a speed setting when launching it. The fastest encrypts 1 percent of each file and the slowest of the quick modes 9 percent. It can also be pointed at system drives only, or network shares only. Each file gets its own X25519 and XChaCha20 key.
Windows, Linux and ESXi
Builds exist for Windows, Linux, NAS devices and VMware ESXi. On ESXi it stops the virtual machines and encrypts their disks. It also installs itself to run again after a reboot.
Data taken first
Files are copied out before encryption, in documented cases with AzCopy to attacker-controlled cloud storage, from hundreds of gigabytes to several terabytes. The leak site names the victim, posts samples and then publishes the rest.
Active against Australia
Our breach tracker has two confirmed Australian victims in mid-2026, both in food and agriculture, and leak-site claims add at least five more across printing, retail, IT services, office technology and financial services. The group also runs a botnet of more than 1,500 compromised hosts, so its real reach is larger than its leak site.
The Gentlemen and FortiGate
If you run a FortiGate, start at the firewall.
Most documented Gentlemen intrusions trace back to a FortiGate firewall or VPN. This is what to check, in order, before anything is rebuilt.
Why FortiGate SSL VPN keeps being the way in →Keep the firewall logs, then cut the route
Export the FortiGate logs and configuration before anyone changes the box. Look for admin logins from unfamiliar addresses, new local admin accounts and firmware behind Fortinet's current advisories. Then disable remote management from the internet, rotate every account that can sign in to it and turn on multi-factor authentication. Do not factory reset it. That is your evidence.
Check the security tools before you trust them
GentleKiller stops endpoint agents at kernel level. A console showing every machine as healthy may simply mean the agents were killed. Confirm agents are actually running on the domain controllers and servers before relying on them for containment.
Treat Active Directory as compromised
Group Policy was used to deploy the encryptor, so review recent GPO changes, new scheduled tasks and new accounts. Reset privileged credentials, including the Kerberos service account twice, as part of containment rather than the clean-up afterwards.
Do not just reboot the ESXi hosts
Researchers found the ESXi build adds itself to /etc/rc.local.d and the root crontab so it runs again shortly after boot. Leave the hosts and datastores as they are until someone has checked for that. Never recreate VMs or reformat the datastore. Those VMDKs are what a recovery reads back.
The honest answer
Can The Gentlemen-encrypted files be recovered?
Often, substantially, yes, when the affiliate used one of the speed modes. At 1, 3 or 9 percent per file, a large database, virtual disk or archive keeps most of its data physically intact on disk. That data can be found, carved and rebuilt without the attacker's key. Virtual machine disks on ESXi are the strongest candidates, because they are large and highly structured.
Two honest caveats. There is no flaw in the X25519 and XChaCha20 scheme and no public decryptor, so whatever was fully encrypted comes back only from backups. And small files are usually a loss whatever the mode. The build, the extension and a sample of encrypted files tell us within hours which situation you are in.
Keep every encrypted file and every README-GENTLEMEN.txt where it is, and do not let anyone rebuild affected machines or ESXi hosts before the assessment. The file sizes, the extension and the note are what a recovery works from.
Common questions
The Gentlemen, in plain terms.
Mid-incident and need a straight answer? Call 1300 004 766. A person answers, 24 hours a day.
What is README-GENTLEMEN.txt?
It is the ransom note left by The Gentlemen, a ransomware-as-a-service operation active since August 2025. It usually sits beside files renamed with a random six-character extension. Keep the note and the files. They identify the build and are often the starting point of a recovery.
Is there a free decryptor for The Gentlemen?
No. Each file is encrypted with its own X25519 and XChaCha20 key, no flaw has been published and nothing is listed on nomoreransom.org. The realistic recovery paths are backups, snapshots, and the data the encryptor never touched, which in its speed modes is most of every large file.
Can files encrypted by The Gentlemen be recovered without paying?
Often, partially, and sometimes substantially. The fast modes encrypt only 1 to 9 percent of each file, so databases, virtual disks and archives usually keep most of their data intact, and that can be rebuilt without the attacker's key. It is a recovery effort with honest limits, not a guarantee. Small files and anything encrypted in full need backups.
Our antivirus showed nothing. How did it get past?
The Gentlemen disables security tools before it encrypts. ESET documented GentleKiller, which abuses vulnerable drivers to stop more than 400 processes from around 48 security products, including Microsoft Defender, CrowdStrike and SentinelOne. The quiet console is part of the attack. Check whether the agents are actually running before relying on them.
They hit our ESXi hosts. What should we not do?
Do not reinstall or recreate the hosts, do not reformat datastores and do not restore over the encrypted VMDKs. Be careful with simple reboots too: the ESXi build has been seen adding itself to the startup scripts and root crontab. Leave everything as it is and get an assessment first.
What should we do in the first hour?
Isolate the affected machines but leave them powered on, take surviving backups offline, export the FortiGate logs and start a simple timeline. Data has almost certainly been copied out, so the Privacy Act notification question runs in parallel with recovery. If a ransom is paid and turnover is above $3 million, a payment report is due within 72 hours. Do not rebuild, do not run cleanup tools and do not pay in a panic. Our First-Response Guide covers this on one printable page, and 1300 004 766 is answered around the clock.
Not The Gentlemen?
The extension on your files names the strain.
If the note or extension does not match what is on this page, one of these may fit. If none of them do, call anyway: the strain shapes the recovery, but identifying it is our job, not yours.
.akira
Akira →
Consistently among the most active strains in Australia. Partial encryption by design.
random extension
Qilin →
The most active operation of 2026. Every victim gets a unique file extension.
.inc
INC Ransom →
Subject of a 2026 ACSC joint advisory. Heavy targeting of Australian healthcare.
.LYNX
Lynx →
Built on the INC Ransom code. Encrypts 5, 15 or 25 percent of each file, so most of a large file survives.
.fog / .flocked
Fog →
Education-focused, enters via VPN credentials, attacks backups first.
.safepay
SafePay →
Encryption depth is a setting, and operators pick shallow. Enters on valid VPN and RDP credentials.
.dragonforce_encrypted
DragonForce →
Full, partial or header-only per file. Dedicated ESXi builds hit whole virtual estates.
no extension (via your IT provider)
Storm →
New in August 2026. Reaches Australian businesses through a compromised IT provider and lists them with long countdowns.
no extension (theft only)
Kairos →
Never encrypts. Steals data and runs a seven-day clock. Nine Australian victims since 2024.
WHAT_HAPPENED.readme.txt
Lamashtu →
Appeared April 2026 and resumed listing in September. Gives three days to make contact and ten before it publishes.
Or start from ransomware recovery, which covers the method whatever the strain turns out to be.
After the incident
The same responders, before the next one.
Most The Gentlemen recoveries end with the same short list: the remote access that had no MFA and the backup the attacker could reach. Fortify is our managed security plan, built from that list. Fortify clients get this incident response team as part of the plan, with no hourly cap on in-scope incidents.
Right now
The first hours decide what can be saved.
Isolate the machines, keep the encrypted files, take backups offline, and call before anything gets rebuilt. Australian incident response, answered by a real person.
Outcomes described are specific engagements. No recovery is guaranteed.