May 15, 2026, 06:07 PM
The Gentlemen's RaaS
(note: breached.st has official partnered with The Gentlemen's RaaS https://breached.su/threads/breachforums...hip.87178/)
DLS / BLOG
http://tezwsse5czllksjb7cwp65rvnk4oobmzt...qkad.onion
We welcome teams, individual pentesters, and access brokers to join our affiliate program.
90% YOUR SHARE
YOU CONTROL THE NEGOTIATIONS
Each build automatically generates a ransom note on the victim’s machine with your contact details (Tox, Session, Ricochet, Email, Jabber, or any other channel).
You have full control over negotiations. If the victim contacts our main Tox account, it will be automatically forwarded to you.
Minimal service infrastructure (DLS + Tox) ensures maximum safety for affiliates and reduces the attack surface.
---
LOCKER / UNLOCKER
A proven locker used in real-world incidents. Data recovery companies are powerless against it.
Decryption is impossible without the private key, which exists only inside the decryptor. https://github[.]com/Bedrock-Safeguard/gentlemen-decryptor - that was became useless even in dream scenario in first release hour. Go CVE fixed with secure memory zeroing.
Cross-platform support with a single unlocker base for both Windows and Linux (a Linux decryptor can decrypt files encrypted on Windows and vice versa).
### Windows / Linux / NAS / BSD
Language: Go
- Hybrid cryptography: XChaCha20 + Curve25519 (asynchronous encryption)
- Unique ephemeral key per file + crypto marker
- Automatic encryption mode selection (partial / full)
- Flexible speed modes:
- `--fast` — 9%
- `--superfast` — 3%
- `--ultrafast` — 1%
- Operation modes:
- `--system` — local drives only (from SYSTEM)
- `--shares` — network shares and mapped drives only
- `--full` — two-phase mode: local drives first (SYSTEM), then all network resources
- Multithreaded operation
- Daemonization (runs in background)
- Password protection for every build (both locker and decryptor)
- Ability to specify local or network paths for targeted/priority encryption
- Automatic network discovery (including Windows 11)
- Encryption of all available network shares in the domain after processing local disks
- Forced access to folders and directories
- Well-thought-out exclusion list
- Extended process and service kill list with restart prevention
- Can run as a regular user (no admin rights required). Recommended to run as domain/local admin or via GPO/Schtasks as SYSTEM
- Multiple locker instances can run simultaneously on the same machine without conflicts or data corruption
- After completion: wallpaper change + readme.txt with instructions
- Full self-destruction, maximum trace wiping (logs, shadow copies, etc.)
- Works with all hidden mount points and data clusters (including Hyper-V CSV clusters)
- Timer support
- Race condition protection (no mutex - can run multiply instances , unique scheme)
- Spreading features (multiple methods in a single flag)
- **GPO spreading** — domain-wide distribution via Group Policy with proper triggers
- Automatic restart protection (via schtasks + registry) in case of cut-off or reset
- **Silent mode** — does not change file names or modification dates. Notes are dropped only into domain and local admin folders. No wallpaper change
---
ESXi
**Language:** C
- One of the best ESXi lockers available
- Binary size: **32 KB**
- Multithreaded operation
- Hybrid cryptography: XChaCha20 + Curve25519
- Proper daemonization. Survives SIGHUP (no need for nohup or scripts — single ELF)
- Password protection for each build
- Multi-stage reliable VM shutdown with restart prevention
- Ability to exclude specific VMs (by name) from encryption/shutdown queue
- Works on all file systems
- Exclusion list to maintain host and VM operability after encryption
- Heap memory exhaustion fix for ESXi 7.0 + runtime optimization
- After completion: sets Message Of The Day (`/etc/motd/`) + creates readme.txt
- Timer support
- Automatic restart protection
- Race condition protection on VSAN ESXi clusters
---
## Partnership Requirements
**!!! WORK IN RUSSIA AND CIS COUNTRIES IS STRICTLY PROHIBITED !!!**
Access to the builder is granted **only after** you provide files/data from a prepared target ready for encryption.
Data must be uploaded to a public cloud or another agreed-upon resource. Collected data will be published on our blog.
If providing data is not possible, you must justify the reason and deposit **$1500** to our wallet. The deposit is refunded after the first successful payment.
This measure filters out researchers and law enforcement.
Verified partners also receive access to:
- EDR killers
- Custom multichain pivot (server + client)
- Builder panel with online decryption of 3 Windows/Linux files + 3 ESXi files
Recent Technical Improvements:
The locker has demonstrated successful operation even under active EDR from a well-known vendor./
---
First contact — via TOX:
F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E
https://bf.st/attachments/1513/
---
References:
- https://www.trendmicro.com/en_us/researc...mware.html
- https://www.ransomware.live/group/thegentlemen
- https://research.checkpoint.com/2026/dfi...gentlemen/
- https://socradar.io/blog/dark-web-profil...ansomware/
(note: breached.st has official partnered with The Gentlemen's RaaS https://breached.su/threads/breachforums...hip.87178/)
DLS / BLOG
http://tezwsse5czllksjb7cwp65rvnk4oobmzt...qkad.onion
We welcome teams, individual pentesters, and access brokers to join our affiliate program.
90% YOUR SHARE
YOU CONTROL THE NEGOTIATIONS
Each build automatically generates a ransom note on the victim’s machine with your contact details (Tox, Session, Ricochet, Email, Jabber, or any other channel).
You have full control over negotiations. If the victim contacts our main Tox account, it will be automatically forwarded to you.
Minimal service infrastructure (DLS + Tox) ensures maximum safety for affiliates and reduces the attack surface.
---
LOCKER / UNLOCKER
A proven locker used in real-world incidents. Data recovery companies are powerless against it.
Decryption is impossible without the private key, which exists only inside the decryptor. https://github[.]com/Bedrock-Safeguard/gentlemen-decryptor - that was became useless even in dream scenario in first release hour. Go CVE fixed with secure memory zeroing.
Cross-platform support with a single unlocker base for both Windows and Linux (a Linux decryptor can decrypt files encrypted on Windows and vice versa).
### Windows / Linux / NAS / BSD
Language: Go
- Hybrid cryptography: XChaCha20 + Curve25519 (asynchronous encryption)
- Unique ephemeral key per file + crypto marker
- Automatic encryption mode selection (partial / full)
- Flexible speed modes:
- `--fast` — 9%
- `--superfast` — 3%
- `--ultrafast` — 1%
- Operation modes:
- `--system` — local drives only (from SYSTEM)
- `--shares` — network shares and mapped drives only
- `--full` — two-phase mode: local drives first (SYSTEM), then all network resources
- Multithreaded operation
- Daemonization (runs in background)
- Password protection for every build (both locker and decryptor)
- Ability to specify local or network paths for targeted/priority encryption
- Automatic network discovery (including Windows 11)
- Encryption of all available network shares in the domain after processing local disks
- Forced access to folders and directories
- Well-thought-out exclusion list
- Extended process and service kill list with restart prevention
- Can run as a regular user (no admin rights required). Recommended to run as domain/local admin or via GPO/Schtasks as SYSTEM
- Multiple locker instances can run simultaneously on the same machine without conflicts or data corruption
- After completion: wallpaper change + readme.txt with instructions
- Full self-destruction, maximum trace wiping (logs, shadow copies, etc.)
- Works with all hidden mount points and data clusters (including Hyper-V CSV clusters)
- Timer support
- Race condition protection (no mutex - can run multiply instances , unique scheme)
- Spreading features (multiple methods in a single flag)
- **GPO spreading** — domain-wide distribution via Group Policy with proper triggers
- Automatic restart protection (via schtasks + registry) in case of cut-off or reset
- **Silent mode** — does not change file names or modification dates. Notes are dropped only into domain and local admin folders. No wallpaper change
---
ESXi
**Language:** C
- One of the best ESXi lockers available
- Binary size: **32 KB**
- Multithreaded operation
- Hybrid cryptography: XChaCha20 + Curve25519
- Proper daemonization. Survives SIGHUP (no need for nohup or scripts — single ELF)
- Password protection for each build
- Multi-stage reliable VM shutdown with restart prevention
- Ability to exclude specific VMs (by name) from encryption/shutdown queue
- Works on all file systems
- Exclusion list to maintain host and VM operability after encryption
- Heap memory exhaustion fix for ESXi 7.0 + runtime optimization
- After completion: sets Message Of The Day (`/etc/motd/`) + creates readme.txt
- Timer support
- Automatic restart protection
- Race condition protection on VSAN ESXi clusters
---
## Partnership Requirements
**!!! WORK IN RUSSIA AND CIS COUNTRIES IS STRICTLY PROHIBITED !!!**
Access to the builder is granted **only after** you provide files/data from a prepared target ready for encryption.
Data must be uploaded to a public cloud or another agreed-upon resource. Collected data will be published on our blog.
If providing data is not possible, you must justify the reason and deposit **$1500** to our wallet. The deposit is refunded after the first successful payment.
This measure filters out researchers and law enforcement.
Verified partners also receive access to:
- EDR killers
- Custom multichain pivot (server + client)
- Builder panel with online decryption of 3 Windows/Linux files + 3 ESXi files
Recent Technical Improvements:
- Removal of hardware breakpoints to eliminate debug artifacts and bypass DR register-based interception.
- NTDLL unhooking — Restoration of clean syscall stubs in ntdll.dll.
- ETW patching to suppress Event Tracing for Windows.
The locker has demonstrated successful operation even under active EDR from a well-known vendor./
---
First contact — via TOX:
F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E
https://bf.st/attachments/1513/
---
References:
- https://www.trendmicro.com/en_us/researc...mware.html
- https://www.ransomware.live/group/thegentlemen
- https://research.checkpoint.com/2026/dfi...gentlemen/
- https://socradar.io/blog/dark-web-profil...ansomware/