- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,425
The hackers beat them with the same code. Experts have found a way to save data without paying a ransom.
The Gentlemen ransomware victims for the first time got a chance to return their files without paying for a ransom. Canadian company Bedrock Safeguard reported a public way of decrypting the data encrypted by this family, which is also known as hastalamaurete and by the first quarter of 2026 scored more than 320 confirmed victims.
According to Bedrock Safeguard, The Gentlemen now remains one of the most active RaaS groups. Previously, large companies, including Cyberesan, Group-IB, Check Point, ASEC and Trend Micro, considered the encryption scheme almost invulnerable from a cryptographic point of view. The authors of the new report emphasize that the algorithm itself was not hacked. The weakness was its implementation.
The Gentlemen uses XChacha20 streaming and the X25519 ECDH keys exchange. For each file, a separate time pair of keys is created, so direct selection does not make sense. However, malware is written in Go, and the language runtime environment does not clear the cryptographic data from the gault stack and memory after the completion of operations. As a result, temporary private keys can be stored in the process memory all the time the cipherer is working.
Bedrock Safeguard claims that one process memory dump is enough to remove the keys to decrypt files. In the test, the team restored 35 of the 35 files with 100% accuracy, and searching for all keys took 0.6 seconds. Such a dump could be saved in EDR or XDR systems, the incident response group, in Windows Error Reporting, emergency dumps, a full RAM image or hibernation file.
The company also published signs of compromise. Among them are a note README-GENTLEEN.txt, the body’s tail with a GENTLEMEN marker, randomly digitized file extensions, deletion of shadow copies via vssadmin and wmic, adding exceptions to Windows Defender, deleting Prefetch files, stopping database services, backing up and protection, as well as changing wallpaper on gentlemen.bm.
The report links work with the earlier restoration of the WannaCry keys, which Adrien Guine described in 2017. According to Bedrock Safeguard, the new publication was the first open example of the extraction of temporary X25519-keys from memory against the ransomware family. The Canadian Cyber Security Center and RCMP NC3 were notified of the find. The company also introduced the open service Bedrock RansomGuard, which should automatically notice encryption and save process memory while the keys can still be removed. A similar approach – a public decryptor as a result of the analysis of weak crypto-realization – was previously used against the FunkSec ransomware.
The Gentlemen ransomware victims for the first time got a chance to return their files without paying for a ransom. Canadian company Bedrock Safeguard reported a public way of decrypting the data encrypted by this family, which is also known as hastalamaurete and by the first quarter of 2026 scored more than 320 confirmed victims.
According to Bedrock Safeguard, The Gentlemen now remains one of the most active RaaS groups. Previously, large companies, including Cyberesan, Group-IB, Check Point, ASEC and Trend Micro, considered the encryption scheme almost invulnerable from a cryptographic point of view. The authors of the new report emphasize that the algorithm itself was not hacked. The weakness was its implementation.
The Gentlemen uses XChacha20 streaming and the X25519 ECDH keys exchange. For each file, a separate time pair of keys is created, so direct selection does not make sense. However, malware is written in Go, and the language runtime environment does not clear the cryptographic data from the gault stack and memory after the completion of operations. As a result, temporary private keys can be stored in the process memory all the time the cipherer is working.
Bedrock Safeguard claims that one process memory dump is enough to remove the keys to decrypt files. In the test, the team restored 35 of the 35 files with 100% accuracy, and searching for all keys took 0.6 seconds. Such a dump could be saved in EDR or XDR systems, the incident response group, in Windows Error Reporting, emergency dumps, a full RAM image or hibernation file.
The company also published signs of compromise. Among them are a note README-GENTLEEN.txt, the body’s tail with a GENTLEMEN marker, randomly digitized file extensions, deletion of shadow copies via vssadmin and wmic, adding exceptions to Windows Defender, deleting Prefetch files, stopping database services, backing up and protection, as well as changing wallpaper on gentlemen.bm.
The report links work with the earlier restoration of the WannaCry keys, which Adrien Guine described in 2017. According to Bedrock Safeguard, the new publication was the first open example of the extraction of temporary X25519-keys from memory against the ransomware family. The Canadian Cyber Security Center and RCMP NC3 were notified of the find. The company also introduced the open service Bedrock RansomGuard, which should automatically notice encryption and save process memory while the keys can still be removed. A similar approach – a public decryptor as a result of the analysis of weak crypto-realization – was previously used against the FunkSec ransomware.
