John Z Black

John Z Black Apr 21, 2026 Ransomware & Cybercrime #gentlemen #systembc #ransomware #botnet #reconnaissance

Ransomware groups are moving faster than ever. A new operation called The Gentlemen has already claimed over 320 victims this year. But the real threat is the automated machine behind them.

Researchers recently unburied a global botnet of more than 1,500 infected corporate hosts running the SystemBC proxy malware. This is not just opportunistic targeting. It is the industrialization of dwell time.

The botnet acts as a persistent scouting layer. It sits in your network, validates credentials, and confirms privileged access before a human attacker ever touches the keyboard. By the time your team detects something, the domain controller is likely already mapped.

The Gentlemen use this automated infrastructure to mask their location and maintain long term persistence. They deploy their final ransomware payload via Group Policy for a near simultaneous shutdown across the network.

If the Gentlemen are knocking, they have likely had a bot in your building for weeks. You need to check your EDR for SystemBC indicators and unauthorized SOCKS5 tunnels today. Cybersecurity is now a computer speed conflict.

Get the full technical breakdown of The Gentlemen’s ESXi and NAS lockers.