GPO lateral movement

The Gentlemen ransomware group operates a RaaS model targeting large corporations and critical infrastructure worldwide. The group gains initial access through internet-exposed VPN/firewall vulnerabilities and stolen credentials, conducts internal reconnaissance using custom and off-the-shelf tools, and deploys a custom Go-based backdoor for C2 prior to ransomware deployment. The ransomware uses GPO-based and PsExec-based lateral movement, BYOVD techniques to disable security software, and hybrid encryption (Curve25519+XChaCha20 in the Go variant, AES256-GCM+RSA in the emerging C variant). A new C-based variant is under active development, indicating the group is expanding its capabilities.