Kaspersky Details The Gentlemen’s Custom Go Backdoor and New Ransomware Variant

Jun 29, 2026 · Original article ↗

Summary

Kaspersky details The Gentlemen’s ransomware operations, including exposed-service and credential-based access, reconnaissance, BYOVD defense evasion, a custom Go backdoor for command execution and SOCKS proxying, and Go and C-based ransomware variants.

Key points

Kaspersky reports observing The Gentlemen since February 2026; public reports ranked the group among the top 10 ransomware actors by victim announcements in the first half of the year.
Initial access reportedly involves exploiting exposed services, including VPNs and firewalls, or using stolen, weak, leaked, or default credentials. Some observed access preceded ransomware deployment, leading researchers to suggest other actors or initial access brokers may have been involved.
The group uses SharpADWS, NetScan, Advanced IP Scanner, and netsh for network and Active Directory reconnaissance; packet captures could reveal unencrypted activity and potential passwords.
Kaspersky observed a custom Go implant deployed before ransomware activity. It collected host information, maintained C2 communication, and supported command execution and SOCKS proxying.
Reported defense-evasion methods include vulnerable-driver abuse (BYOVD), kernel tools, registry changes, and attempts to disable Windows Defender and Kaspersky products.
The Go ransomware can spread through Group Policy or PsExec and uses Curve25519 with XChaCha20 for encryption. A C-based Windows variant was observed in a limited number of attacks; it uses AES256-GCM with RSA, and several listed features are not yet implemented.
Kaspersky says it has high confidence in attributing the observed activity to The Gentlemen and affiliates, citing the group’s name, associated email addresses, and data leak site in binaries and ransom notes.

Article Details

Attack Vectors: The group and its affiliates gain access by exploiting vulnerabilities in internet-exposed services and devices, including VPNs and firewalls, and by using stolen, weak, leaked, or default credentials. Researchers say some intrusions may involve other actors or initial access brokers.
A custom Go backdoor collects host information and maintains a TCP connection to a C2 server, enabling remote command execution and SOCKS proxying.
Reconnaissance includes Active Directory enumeration, network and service scanning, and packet capture with netsh.
The group moves laterally by distributing ransomware through NETLOGON and Group Policy, and by remotely executing it with PsExec.
Defense evasion includes exploiting vulnerable drivers, using kernel tools to interfere with security software, changing Windows Defender settings, and attempting to uninstall Kaspersky Antivirus.
The ransomware stops processes and services, shuts down Hyper-V virtual machines, encrypts files, and may delete shadow copies and event logs.
Defensive Notes: The article advises prioritizing vulnerability management and system hardening to reduce the risk of compromise.

Indicators of compromise

Type	Indicator	Context
IPV4	`81[.]177[.]215[.]15`	C2 server for the custom Go backdoor; the article gives port 9443.
MD5	`02944c8a5535cdb5b2cbb893db2d5acf`	Hash listed for a Go ransomware sample named locker_lqy8xb_windows_amd64.exe.
MD5	`10ca9a4040001560d053b7e7885c1b95`	Hash listed for a Go ransomware sample named locker_28f3cl_windows_386.exe.
MD5	`3b46a729db7ae6af8b19711c9452194d`	Hash listed for a Go ransomware sample named locker_eryoo5_windows_amd64.
MD5	`3c471ebc947cdf32240a90ffadf49b13`	Hash listed for a Go ransomware sample named locker_aga19g_windows_amd64.exe.
MD5	`407b6a136bbaa7172eb44ef9d08bb58a`	Hash listed for biontdrv_winbs.sys among the vulnerable-driver indicators.
MD5	`4be8bb62f0ebbcf4ce52c35ab6f794f5`	Hash listed for a Go ransomware sample named locker_wh54td_windows_386.exe.
MD5	`525ef6014f0ef20e44fe47c1d9980b69`	Hash listed for biontdrv_wink.sys among the vulnerable-driver indicators.
MD5	`53c616677bc7e2a0a03127f19166d007`	Hash listed for a Go ransomware sample named locker_p663zs_windows_amd64.exe.
MD5	`554e699c96b332468f1ae69c1ae81ef9`	Hash listed for the custom backdoor binary sihost.exe.
MD5	`5761bd63da03686fc480245da7bd1e9f`	Hash listed for ProcessMonitorDriver.sys, a vulnerable driver observed in the group's BYOVD activity.
MD5	`5c3b9821fc82a9028cb63b9671950919`	Hash listed for the Go ransomware binary locker.exe.
MD5	`5f0b2c6d9f442754258bf4dd841c8341`	Hash listed for a Go ransomware sample named locker_t1zged_windows_amd64.exe.
MD5	`608faf58353b65c45ef9833358ac3787`	Hash listed for a Go ransomware sample named locker_u90lyt_windows_amd64.exe.
MD5	`6ae7c9a7ea0b8c40a64225734f6bd01d`	Hash listed for the Go ransomware binary gentle.exe.
MD5	`73f0a8c3ea794a04e80c32038249f044`	Hash listed for wsddprm.sys among the vulnerable-driver indicators.
MD5	`846dc77c1246db20d976346e0e359502`	Hash listed for a Go ransomware sample named locker_p663zs_windows_386.exe.
MD5	`8f0577d28c4ff5f71b149f444bfaba8e`	Hash listed for gamedriverx64.sys, a vulnerable driver observed in the group's BYOVD activity.
MD5	`9321a61a25c7961d9f36852ecaa86f55`	Hash listed for inpoutx64.sys, a vulnerable driver observed in the group's BYOVD activity.
MD5	`adac9984b3cc43d66a0d33079bbec299`	Hash listed for a Go ransomware sample named UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b.
MD5	`ae0e536766788478263bf448a9381641`	Hash listed for a Go ransomware binary named cosmo.exe.
MD5	`b3e418d30312c1b2c58a791286868f42`	Hash listed for a Go ransomware sample named system_386.exe.
MD5	`b6b51508ad6f462c45fe102c85d246c8`	Hash listed for wamsdk.sys, a vulnerable driver observed in the group's BYOVD activity.
MD5	`b9986a0f1f1f1a798dc3f0c59a80a1a3`	Hash listed for fin.exe among the article's Go-ransomware indicators.
MD5	`c2764744dcb4b0e1db79ca1e8bf65368`	Hash listed for a Go ransomware binary named getlwd.exe.
MD5	`d12a5b36dd00586cc374a1cae43efed4`	Hash listed for a Go ransomware sample named locker_c65ffp_windows_amd64.exe.
MD5	`d2f72897e8986303d5567eb2384932b8`	Hash listed for a Go ransomware sample named UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b.
MD5	`de1522f9219497632f30f8a6e72f26b6`	Hash listed for a Go ransomware sample named locker_c7ekh7_windows_amd64.exe.
MD5	`eef8a950952696b018aa9c6da2f5d7ad`	Hash listed for Havoc.sys, a vulnerable driver observed in the group's BYOVD activity.
MD5	`fdae2beb813778b4540a997706862096`	Hash listed for a Go ransomware binary named AIR.exe.