DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

Key Points The Gentlemen ransomware‑as‑a‑service ( RaaS ) program is rapidly gaining popularity, attracting numerous affiliates and publicly claiming over 320 victims , with the majority of attacks ( 240 ) occurring in the first months of 2026. The service provides a broad locker portfolio implemented in Go for Windows , Linux , NAS , and BSD , plus an additional locker written in C for ESXi , enabling coverage of the multiple platforms commonly found in corporate environments.