Somebody on the criminal side noticed defenders take hours to respond and ransomware operators were leaving money on the table. The Gentlemen, a new Go-based encryptor that Microsoft Threat Intelligence wrote up this week, fixed that. It self-propagates. The affiliate drops it once and the malware handles its own lateral movement, hitting multiple targets simultaneously with per-file ephemeral keys so even the recovery path is uglier than usual. Combined with this week’s coverage of AI-supercharged Russian crews and Cisco Talos’s plea for smarter patch triage, the picture is clear: most cybersecurity programs are still paced for a 2019 threat model.

The affiliate just got automated out of a job

Read Microsoft’s writeup on The Gentlemen and notice what’s gone. The bored human operator clicking through PsExec sessions is missing. The encryptor carries its own propagation module, fans out across the network in parallel, and encrypts files with per-file ephemeral keys to break partial-recovery hopes. Worms have existed since Morris. The novelty here is who’s shipping them: ransomware affiliates who used to spend three days getting domain admin now get the encryptor to do that work in minutes.

The economics are brutal. A self-propagating payload drives the affiliate cost per victim toward zero, and the affiliate barely needs to be a skilled operator. Storm-2697 is essentially selling worm-as-a-ransomware-service.

Defenders, meanwhile, still measure their response in business hours.

AI is now scaffolding the rest of the attacker workflow

SecurityWeek’s coverage of the Russia-linked GreyVibe crew documents what every defender already suspected. The group leans heavily on ChatGPT, Gemini, and other commercial AI tools to generate phishing copy, write scaffolding code for tooling, debug their own malware, and translate findings. The article frames it as a glimpse of what future attackers will look like. The behavior is already standard tradecraft.

The thing worth noticing is what AI compresses. GreyVibe’s craft sits mostly within reach of a competent human operator. AI shaves it into a quarter of the time, with thinner staffing, and with fewer of the small mistakes that get crews caught. Pair that scaffolded operator with a worm-grade payload like The Gentlemen and you have a campaign that turns what used to be a week of intrusion work into an evening.

Your incident response runbook still assumes you’ll have hours.

Cybersecurity triage based on CVSS alone is malpractice now

Cisco Talos’s “less panic patching, more precision” newsletter argues something most cybersecurity teams have known privately for years and refused to act on. CVSS scores measure theoretical badness, divorced from real-world exploit pressure. EPSS (the probability a CVE will be exploited in the next 30 days) and GCVE (Google’s contextualized vuln enrichment) give you the operational picture. Change management still runs on “patch everything CVSS 7 and up by Friday” because that’s what the auditors ask for.

Then look at the SANS Internet Storm Center’s year-long DShield sensor analysis. The same files keep getting uploaded to the same honeypots, month after month, with activity peaking in the winter. Attackers are recycling the same exploits against everyone. The CVEs being thrown at your edge today are mostly the ones being thrown at it last quarter.

The patch list worth your time is the one with the highest EPSS, weighted by what actually shows up in your firewall logs and your DShield-equivalent telemetry. Defense in depth means nothing if the inner layers are tuned for threats from 2020.

What actually slows a self-spreading payload down

Defense against worm-class ransomware demands a layered set of unglamorous habits, most of which your team already knows about and has deprioritized for newer, shinier work. Here’s the short list worth doing this quarter:

• Segment east-west traffic for real. The Gentlemen’s self-propagation relies on SMB, WinRM, and RPC reaching machines it shouldn’t. If your flat /16 still treats every workstation as a peer of every server, the worm wins. Microsegmentation between user VLANs and server VLANs is table stakes.
• Disable unused lateral movement protocols at the host level. Most workstations have no business accepting inbound SMB from peers. Most servers have no business accepting inbound WinRM from user subnets. The host firewall is free threat-protection that almost nobody configures.
• Rate-limit and alert on parallel authentication failures. Self-propagating malware will brute-force or pass-the-hash against dozens of hosts simultaneously. A simple velocity rule on Windows event 4625 catches a worm before the encryptor finishes its first file.
• Re-tier your patch backlog using EPSS and known exploitation feeds. CVSS gets you compliance. EPSS plus CISA KEV plus your own log evidence gets you actual security hardening.
• Pre-position offline immutable backups. Per-file ephemeral key ransomware drives partial recovery toward zero. Either you have a clean restore point in cold storage, or you’re paying.
• Rehearse a 30-minute incident response trigger. If your IR playbook waits for a human to notice and a human to escalate and a human to decide, the worm will be done before the bridge call starts. Pre-authorize an on-call engineer to isolate a VLAN and yank a domain controller’s NIC.

All of this is overdue.

Sources

• The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
• Russia-Linked GreyVibe Attackers Use AI to Supercharge Cyberattacks
• Less panic patching, more precision (Cisco Talos)
• Analysis of a Year of Files Uploaded to DShield Sensors