New Kaspersky Global Research and Analysis Team (GReAT) research into the rapidly growing ransomware group known as The Gentlemen has showed that the attackers have evolved their tactics through new custom-built tools – a backdoor designed to facilitate information gathering before ransomware deployment and control over compromised systems, and a ransomware executable file.

The group has been active worldwide across industries including manufacturing, IT services, healthcare, financial services, construction, and logistics.

In its recent report Kaspersky shared an overview of ransomware trends: according to Kaspersky Security Network, in 2025 Latin America had the highest share of organisations with ransomware attacks detected (8.13%), followed by the Asia-Pacific region (7.89%), Africa (7.62%), Middle East (7.27%), the Commonwealth of Independent States (CIS, 5.91%) and Europe (3.82%).

The Gentlemen is a rapidly expanding Ransomware-as-a-Service (RaaS) operation believed to have emerged around mid-2025. The Gentlemen and its affiliates primarily gain initial access to victim systems through the exploitation of Internet-facing services and compromised credentials.

The attackers may be seeking collaboration with Initial Access Brokers (IABs) to acquire access to organisations with valuable intellectual property with minimal effort. Kaspersky found that access to some victim systems, using techniques the group does not typically employ, occurred long before the ransomware infection. This may mean that the initial access was not carried out by The Gentlemen, but rather by another threat actor, possibly an IAB.

Unlike many RaaS groups, The Gentlemen demonstrates a high level of sophistication, employing custom tooling and flexible intrusion tactics. Kaspersky researchers identified a previously unknown, custom-developed backdoor written in Go deployed by the attackers one day before ransomware execution.

The implant gathers host and network information and hides its console window to avoid detection. Its capabilities include bidirectional communications with the attackers, server-controlled command execution, and reconnaissance, enabling attackers to extend and adapt their activity within a compromised environment.

Kaspersky also found a new ransomware variant written in C affecting a limited number of corporate victims. While The Gentlemen has primarily used a ransomware implant written in Go that was designed for cross-platform use, the new C-based variant appears to be Windows-focused. The group may be testing the malware in real victim environments as it expands its technical arsenal.

Notably, in their attacks the Gentlemen attempted to remove the Kaspersky security solution by utilising kavrmvr.exe (a tool designed to remove Kaspersky products). However, the Kaspersky solution remained active, and the move by the attackers was blocked and flagged as malicious.

“Despite being a relatively recent entrant to the ransomware threat landscape, The Gentlemen group is rapidly gaining a reputation among threat actors, attracting affiliates and executing high-profile attacks.

“The testing of the new C-based ransomware variants suggests that the group is actively refining its capabilities, which may translate into more stable and scalable attack chains in the near future.

“Organisations should anticipate further malicious ransomware activity and are strongly advised to prioritise vulnerability management and system hardening processes to mitigate the risk of compromise,” said Fatih Sensoy, security expert at Kaspersky GReAT.

From January to April 2026, Kaspersky security solutions detected more than 33,300 attacks on small and medium-sized businesses (SMBs), in which malicious or unwanted software for PCs were disguised as popular artificial intelligence (AI) services. This number has surged by almost five times when compared to the same period in 2025.

A new Kaspersky report reveals threat analysis and mitigation strategies to help SMBs protect themselves against the evolving threat landscape.

Kaspersky experts explored the extent to which threat actors target small and medium-sized businesses with malware disguised as legitimate AI services, considering the growing popularity of such tools for the business workflow. At the beginning of 2026 the most common lures in cyberattacks involved malware posing as ChatGPT (42%), Claude (24%), and DeepSeek (20%).

Among unique malicious files detected in the SMB sector and masqueraded as AI services, Kaspersky experts observed mainly different Trojware (Trojans and Trojan-like malware), including those capable of downloading and running other malware on compromised devices.

Trojware disguises itself as harmless files to trick users into installing them. Their functionality may vary depending on the type of the malware. It may include stealing, deleting, blocking, modifying or copying users’ data, as well as other malicious capabilities. Given this, Trojware represents a highly dangerous cyberthreat to entrepreneurs and businesses.

However, in 2026 Kaspersky telemetry detected even more attacks on SMBs, in which malicious or unwanted software for PCs were disguised as messenger apps and video conferencing software: Telegram, WhatsApp, Zoom and Microsoft Teams. From January to April Kaspersky solutions blocked almost 415,000 such attacks.

The number of attacks changed marginally compared to the previous year’s figures. Thus, Kaspersky experts note that the lure of fake communication apps remains a widespread cyberthreat.

“The threat landscape is evolving with new lures constantly appearing. For example, for the first four months of this year our solutions for small and medium-sized businesses detected hundreds of attacks, in which malicious or unwanted software were disguised as OpenClaw – an AI tool that rapidly gains popularity in 2026.

Corporate employees are increasingly using various AI services and other tools in their workflows, including those that are publicly available. Thus, to be on the safe side, SMB employees – as well as all users – should exercise caution when looking for software on the Internet. Always check the correct spelling of the website and links in suspicious emails, and use robust security solutions,” says Vasily Kolesnikov, security expert at Kaspersky.

“As adversaries constantly refine their methods to exploit human error, the need for up-to-date security awareness training for businesses of all kinds and sizes is undeniable. However, the reality is that micro-organisations often struggle to allocate time and budget to regularly update their staff on the latest threats and malicious trends.

“We believe this issue can be largely addressed through solutions tailored for small businesses which deliver robust core protection while also providing accessible security education,” adds Rodion Pyanov, product manager, Kaspersky Small Office Security.

LG Electronics has reaffirmed its commitment to advancing innovation and smart living across Africa by participating as a supporting sponsor at the Africa Technology Expo (ATE) 2026, where the company is showcasing its latest portfolio of premium consumer electronics and home appliance innovations.

The two-day expo, themed around strengthening Africa’s enterprise technology ecosystem through collaboration and innovation, has brought together industry leaders, technology innovators, multinational companies, policymakers, and entrepreneurs to explore opportunities for cross-border partnerships and digital transformation across the continent.

As one of the supporting sponsors of this year’s event, LG’s interactive exhibition booth has become a major attraction, offering visitors firsthand experience of the company’s latest AI-powered technologies designed to enhance everyday life while delivering greater comfort, convenience, energy efficiency, and connectivity.

Among the innovations on display are the latest LG QNED TV, delivering exceptional picture quality and immersive entertainment; the iconic MoodUP™️ Refrigerator, which combines intelligent cooling with customizable LED door panels; the innovative LG WashTower™️, an all-in-one premium laundry solution that maximizes space and efficiency; the energy-efficient LG ARTCOOL Air Conditioner and LG Air Tower, designed to provide smarter climate control; alongside LG’s advanced Dehumidifier and other intelligent home solutions.

Speaking on LG’s participation, Mr. H.S. ji, Managing Director, LG Electronics West Africa, said: “Africa Technology Expo provides an excellent platform to engage with innovators, businesses, and consumers who are shaping the future of technology across the continent. At LG, innovation goes beyond creating advanced products, it is about developing meaningful solutions that improve everyday life.

“Our participation reflects our commitment to supporting Africa’s digital transformation while introducing intelligent technologies that make homes and workplaces smarter, healthier, and more energy-efficient.”

The Africa Technology Expo was established to foster stronger collaboration among African businesses, emerging enterprises, and multinational organisations. During the opening ceremony, the organisers emphasized the need for deeper continental collaboration to unlock Africa’s innovation and economic potential, noting that previous editions of the expo have facilitated approximately $192 million in business deals among participating companies.

LG’s presence at the event aligns with this vision by demonstrating how cutting-edge consumer technology can support economic growth, digital inclusion, and sustainable development across Africa.

Visitors to the LG booth are participating in live product demonstrations, interactive experiences, and expert consultations, gaining valuable insights into how LG’s AI-powered ecosystem seamlessly connects home appliances and entertainment products to deliver a smarter lifestyle.

As technology continues to reshape industries and everyday living, LG remains committed to driving innovation that empowers consumers, supports enterprise growth, and contributes to Africa’s evolving digital economy.