Threats Behind the Mask of Gentlemen Ransomware

Gentlemen is a Go-based ransomware group identified in August 2025 that uses double extortion, rapid internal propagation, GPO manipulation, BYOVD, and targeted evasion techniques to attack medium-to-large organizations across multiple industries and regions. The ransomware encrypts files using X25519 and XChaCha20 with per-file ephemeral keys, requires a correct execution password, and…

Read More
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits

Check Point Research dissects the modular ValleyRAT (aka Winos/Winos4.0) backdoor, reverse engineering leaked builder artifacts and mapping all main plugins including an embedded kernel‑mode rootkit. The analysis highlights APC-based user‑mode injection, kernel-level forced deletion of AV/EDR drivers, valid-signed drivers loadable on Windows 11, and a rapid surge in in‑the‑wild samples since the builder leak. #ValleyRAT #SilverFox

Read More