The Gentlemen are knocking: сustom backdoors and evolving tactics

1. Executive summary

The Gentlemen, a ransomware-as-a-service (RaaS) operation active since mid-2025 and ramping significantly through 2026, has been attributed to Storm-2697 by Microsoft Threat Intelligence. The group ranks among the top ransomware actors by victim count, with Check Point reporting at least 332 published victims since inception and 240+ in 2026 alone. The group targets internet-exposed VPNs and firewalls for initial access, deploys a Go-based ransomware with aggressive self-propagation via GPO and PsExec, and has begun developing a C-based variant using AES256-GCM + RSA encryption. Attribution to "The Gentlemen" is corroborated across Kaspersky, Microsoft, Check Point, and BleepingComputer; however, the actor name "The Gentlemen" has no MITRE ATT&CK profile in the verified reference data, and attribution must be treated as unconfirmed per Adverse Trace policy. EMEA financial services organisations are directly within the targeting scope — financial services is explicitly named as a targeted vertical.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Initial access — The Gentlemen and affiliates exploit vulnerabilities in online services and use stolen or weak credentials against internet-exposed hardware VPNs and firewalls. Multiple cybersecurity vendors corroborate this. Some cases involve initial access brokers (IABs) establishing access long before ransomware deployment.
2. Internal reconnaissance — The group deploys: - SharpADWS — gathers Active Directory information via domain object enumeration; bypasses standard logging by wrapping LDAP queries in SOAP messages. - NetScan (netscan64.exe, SHA256: EDB1C480295250DD1A38F3AA1357DEAE) — network scanning, port/service discovery. - Advanced IP Scanner (Advanced_IP_Scanner_2.5.4594.1.exe, SHA256: 5537C708EDB9A2C21F88E34E8A0F1744) — network scanning. - netsh — packet capture via: cmd.exe /Q /c netsh trace start capture=yes report=no filemode=circular overwrite=yes maxSize=4 > \<target IP>\ADMIN$\{RANDOM-FILE-NAME} 2>&1 and stopped with cmd.exe /Q /c netsh trace stop > \<target IP>\ADMIN$\{RANDOM-FILE-NAME}. Captured data saved to ADMIN$ share with random filename; analysed with Wireshark for unencrypted credentials.
3. Backdoor deployment — A custom Go implant is deployed approximately one day before ransomware execution. Capabilities: - Collects system info (hostname, domain, UUID, local IP addresses) into JSON with keys: name, domain, uuid, localIPs. - UUID obtained via WMI: SELECT UUID FROM Win32_ComputerSystemProduct. - C2: 81.177.215[.]15:9443 (port 9443 TCP). - Uses Yamux library for persistent bidirectional TCP connection. - Command execution: if C2 response byte is c, executes via cmd.exe /c; if byte is s, establishes SOCKS proxy. - Observed reconnaissance commands: whoami, net group "Domain Admins" /domain, net group, dir c:\, cd c:\.
4. Security software disabling — Multiple methods: - BYOVD (Bring Your Own Vulnerable Driver) — installs and exploits vulnerable drivers to kill EDR/AV: | Driver | Description | SHA256 | |---|---|---| | ProcessMonitorDriver.sys | Safetica DLP/EDR | 5761BD63DA03686FC480245DA7BD1E9F | | wamsdk.sys | WatchDog anti-malware | B6B51508AD6F462C45FE102C85D246C8 | | gamedriverx64.sys | Fedeen/Hotta anti-cheat | 8F0577D28C4FF5F71B149F444BFABA8E | | biontdrv.sys / biontdrv_wink.sys / biontdrv_winbs.sys | Paragon partition manager | 525EF6014F0EF20E44FE47C1D9980B69 / 407B6A136BBAA7172EB44EF9D08BB58A | | inpoutx64.sys | RGB lighting driver | 9321A61A25C7961D9F36852ECAA86F55 | | wsftprm.sys / wsddprm.sys | Topaz anti-fraud | 73F0A8C3EA794A04E80C32038249F044 | | Havoc.sys / havoc.sys | Huawei audio | EEF8A950952696B018AA9C6DA2F5D7AD |

• Open-source tools: Windows Kernel Explorer and OpenArk64 — intercept/block system calls, remove security drivers.
• kavrmvr.exe — attempts Kaspersky AV uninstall (blocked by behavioural detection).
• Registry-based Windows Defender disable: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] "DisableAntiSpyware"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection] "DisableBehaviorMonitoring"=dword:00000001 "DisableOnAccessProtection"=dword:00000001 "DisableScanOnRealtimeEnable"=dword:00000001
• PowerShell Defender disable (from Go implant): powershell Set-MpPreference -DisableRealtimeMonitoring $true -Force Set-MpPreference -EnableControlledFolderAccess Disabled -Force Add-MpPreference -ExclusionProcess <file_name> Add-MpPreference -ExclusionPath 'C:\'

5. Lateral movement and propagation: - GPO-based: ransomware generates deploy_gpo.ps1 in %temp%, copies itself to NETLOGON share, creates fake system update policy disabling Defender real-time monitoring, creates ScheduledTasks.xml in SYSVOL, modifies AD property gPCMachineExtensionNames, forces gpupdate /force on all computers. - PsExec-based: if PsExec absent, downloads from https://live.sysinternals[.]com/PsExec.exe to C:\Temp\psexec.exe. Uses RSAT installation via Add-WindowsCapability, DISM.exe, Install-WindowsFeature, Get-ADComputer -Filter * to enumerate domain computers. Pings targets with ping.exe -n 1 -w 500 {target}. Spreads via PsExec to active hosts. - Hyper-V termination: Get-VM | Stop-VM -Force -TurnOff to encrypt VM disk files.
6. Encryption (Go variant): - Hybrid: Curve25519 + XChaCha20 stream cipher. - Per-file ephemeral Curve25519 key pair; shared secret computed against attacker public key (Base64): HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=. - File ACL modified to "Everyone: Full Control" before encryption. - Execution password (current build): CbdU8EgF — anti-sandbox mechanism. - Obfuscated with Garble (per Microsoft) — renames symbols, source files, structures, alters function signatures. - Ransom note: README-GENTLEMEN.txt containing victim ID, Tox ID, DLS address. - Desktop wallpaper changed (unless --silent). - Key parameters: --password, --path, --T (minutes), --system, --shares, --full, --spread (domain creds), --gpo, --silent, --keep, --wipe, --no-admin, --fast (9%), --superfast (3%), --ultrafast (1%).
7. Persistence: schtasks.exe /Delete /TN "UpdateUser" /F schtasks.exe /Create /SC ONSTART /TN "UpdateUser" /TR "<ransomware_path>" reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GupdateS" /t REG_SZ /d "<ransomware_path>" /f
8. Anti-recovery and cleanup: vssadmin.exe delete shadows /all /quiet wmic.exe shadowcopy delete wevtutil.exe cl System wevtutil.exe cl Application wevtutil.exe cl Security cmd.exe /C del /f /q C:\Windows\Prefetch\*.* cmd.exe /C del /f /q C:\ProgramData\Microsoft\Windows Defender\Support\*.* cmd.exe /C del /f /q %SystemRoot%\System32\LogFiles\RDP*\*.* cmd.exe /C rd /s /q C:\$Recycle.Bin
9. Double extortion — Microsoft confirms data exfiltration alongside encryption, with threat of public release via DLS.

C-based variant (in development)

• Limited deployment observed; structure similar to Go variant.
• Encryption: AES256-GCM + RSA (OpenSSL statically linked). Random 32-byte key + 16-byte IV per file; 48-byte buffer encrypted with hardcoded RSA public key, appended to file; file contents encrypted with AES256-GCM.
• ACL modification via SetEntriesInAclA API with FULL_CONTROL permission.
• Scheduled task for SYSTEM execution: schtasks /create /sc DAILY /tn "TaskSystem" /tr "cmd /C cd %s && %s" /st 20:00 /ru system > nul, then schtasks /run /tn TaskSystem > nul.
• Ransom note: !-READ-ME—-GEN-TLE-MEN-!.txt (XOR-decoded byte array).
• Communication via email (not Tox, unlike Go variant).
• Log clearing via EvtClearLog API (System, Forwarded Events, Application, Setup — note: "S" category appears to be a typo/bug).
• Smaller denylists than Go variant — confirms developmental status.
• Several parameters not yet implemented: --ex, --fast, --superfast, --ultrafast, --silent, --shares, --full.

Confidence caveats

• Attribution to "The Gentlemen" / Storm-2697 is corroborated by Kaspersky, Microsoft, Check Point, and BleepingComputer. However, "The Gentlemen" has no MITRE ATT&CK profile in the verified reference data — attribution is treated as unconfirmed per Adverse Trace policy.
• The real-world identity attribution (Alexander Andreevich Yapaev, Izhevsk) is single-sourced to Krebs on Security / Constella Intelligence / Intel 471 — verify before enforcement.
• The C variant analysis is based on a limited number of attacks and is assessed as in-development.

4. Mitigation & containment

P1 — Within 24 hours

1. Block C2 infrastructure at firewall/proxy/DNS: - 81.177.215[.]15 — backdoor C2 (port 9443 TCP). - live.sysinternals[.]com — legitimate but abused for PsExec download; consider blocking from non-admin endpoints or restricting to approved admin workstations only.
2. Hunt for backdoor implant — search endpoints for: - Go binaries making TCP connections to 81.177.215.15:9443. - WMI query SELECT UUID FROM Win32_ComputerSystemProduct executed by unsigned Go binaries. - JSON containing keys name, domain, uuid, localIPs in process memory or network traffic.
3. Hunt for ransomware binaries — search for files matching: - Filenames: locker.exe, gentle.exe, cosmo.exe, system_386.exe, getlwd.exe, AIR.exe, fin.exe, sihost.exe, UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b (see IOC table for full list). - Files containing string CbdU8EgF (execution password). - Files containing Base64 key HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=.
4. Hunt for BYOVD drivers — search for presence of: - ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, biontdrv_wink.sys, biontdrv_winbs.sys, inpoutx64.sys, wsftprm.sys, wsddprm.sys, Havoc.sys, havoc.sys — especially in non-standard locations or loaded by non-signed processes.
5. Hunt for reconnaissance tools — search for: - netscan64.exe (SHA256: EDB1C480295250DD1A38F3AA1357DEAE) - Advanced_IP_Scanner_2.5.4594.1.exe (SHA256: 5537C708EDB9A2C21F88E34E8A0F1744) - SharpADWS execution (LDAP-over-SOAP traffic). - netsh trace start commands in process logs.
6. Hunt for deploy_gpo.ps1 — search %temp% and SYSVOL for: - deploy_gpo.ps1 - ScheduledTasks.xml in SYSVOL directory - Modifications to AD property gPCMachineExtensionNames
7. Hunt for ransom notes: - README-GENTLEMEN.txt (Go variant) - !-READ-ME—-GEN-TLE-MEN-!.txt (C variant)
8. EDR rules — create detection for: - Set-MpPreference -DisableRealtimeMonitoring $true executed by non-Microsoft signed processes. - Add-MpPreference -ExclusionPath 'C:\' — blanket exclusion. - Registry modifications to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection setting DisableBehaviorMonitoring, DisableOnAccessProtection, DisableScanOnRealtimeEnable to 1. - schtasks.exe /Create /SC ONSTART /TN "UpdateUser" — persistence mechanism. - schtasks /create /sc DAILY /tn "TaskSystem" — C variant persistence. - reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GupdateS" — Run key persistence. - vssadmin.exe delete shadows /all /quiet — shadow copy deletion. - wevtutil.exe cl — event log clearing.

P2 — Within 72 hours

1. Audit NETLOGON and SYSVOL shares — verify only legitimate scripts/binaries are present. Review NTFS permissions and recent file additions.
2. Audit GPO changes — review all Group Policy objects for unauthorised modifications, particularly any disabling Windows Defender real-time monitoring.
3. Review scheduled tasks — hunt for UpdateUser and TaskSystem across all endpoints.
4. Review Run keys — check HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for GupdateS entry.
5. Network segmentation review — ensure EDR/AV communication cannot be blocked by BYOVD. Consider driver blocklisting for all listed vulnerable drivers via WDAC (Windows Defender Application Control) or ASR rules.
6. Credential hygiene — audit for weak/default credentials on VPNs and firewalls. Enforce MFA. Rotate credentials for any service accounts with domain-wide privileges.
7. Backup verification — verify offline/immutable backups exist and are tested. The group deletes shadow copies and wipes free space.

P3 — Within 7 days

1. Patch internet-exposed devices — VPNs, firewalls, and other edge devices should be patched to latest vendor versions. The Gentlemen actively exploit known vulnerabilities in these devices.
2. Implement driver blocklisting — deploy WDAC policy or third-party EDR driver allow-listing to prevent loading of: ProcessMonitorDriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, biontdrv_wink.sys, biontdrv_winbs.sys, inpoutx64.sys, wsftprm.sys, wsddprm.sys, Havoc.sys, havoc.sys.
3. Restrict PsExec — remove PsExec from non-admin endpoints. Block live.sysinternals.com from endpoint egress. Consider AppLocker/WDAC rules preventing PsExec execution outside approved admin contexts.
4. Hyper-V monitoring — alert on Get-VM | Stop-VM -Force -TurnOff commands from non-admin or unexpected contexts.
5. RSAT installation monitoring — alert on Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" or Install-WindowsFeature RSAT-AD-PowerShell executed outside change management windows.
6. Tabletop exercise — run a DORA Art. 24 digital operational resilience test scenario based on The Gentlemen TTPs: initial access via VPN credential compromise → Go backdoor deployment → GPO-based ransomware propagation. Validate detection at each stage.

5. Indicators of compromise

sha256  3B46A729DB7AE6AF8B19711C9452194D
sha256  02944C8A5535CDB5B2CBB893DB2D5ACF
sha256  10CA9A4040001560D053B7E7885C1B95
sha256  3C471EBC947CDF32240A90FFADF49B13
sha256  4BE8BB62F0EBBCF4CE52C35AB6F794F5
sha256  53C616677BC7E2A0A03127F19166D007
sha256  5C3B9821FC82A9028CB63B9671950919
sha256  5F0B2C6D9F442754258BF4DD841C8341
sha256  608FAF58353B65C45EF9833358AC3787
sha256  6AE7C9A7EA0B8C40A64225734F6BD01D
sha256  846DC77C1246DB20D976346E0E359502
sha256  ADAC9984B3CC43D66A0D33079BBEC299
sha256  AE0E536766788478263BF448A9381641
sha256  B3E418D30312C1B2C58A791286868F42
sha256  C2764744DCB4B0E1DB79CA1E8BF65368
sha256  D12A5B36DD00586CC374A1CAE43EFED4
sha256  D2F72897E8986303D5567EB2384932B8
sha256  DE1522F9219497632F30F8A6E72F26B6
sha256  FDAE2BEB813778B4540A997706862096
sha256  B9986A0F1F1F1A798DC3F0C59A80A1A3
sha256  554E699C96B332468F1AE69C1AE81EF9
sha256  5761BD63DA03686FC480245DA7BD1E9F
sha256  B6B51508AD6F462C45FE102C85D246C8
sha256  8F0577D28C4FF5F71B149F444BFABA8E
sha256  525EF6014F0EF20E44FE47C1D9980B69
sha256  407B6A136BBAA7172EB44EF9D08BB58A
sha256  9321A61A25C7961D9F36852ECAA86F55
sha256  73F0A8C3EA794A04E80C32038249F044
sha256  EEF8A950952696B018AA9C6DA2F5D7AD
sha256  EDB1C480295250DD1A38F3AA1357DEAE
sha256  5537C708EDB9A2C21F88E34E8A0F1744
ipv4  81.177.215.15
filepath  \\Netlogon\
filepath  C:\Sharing
filepath  C:\Temp
filepath  C:\Netlogon
filepath  C:\Windows\sysvol\domain\scripts\
filepath  %TEMP%
filepath  %User%\Downloads
filepath  %User%\Desktop

6. Detection

YARA rule

rule Gentlemen_Ransomware_Go_Variant {
    meta {
        author = "Adverse Trace"
        date = "2026-06-29"
        reference = "https://securelist.com/the-gentlemen-raas/120447/"
        description = "Detects The Gentlemen Go-based ransomware and backdoor implant based on strings from Kaspersky analysis"
    }

    strings:
        $password = "CbdU8EgF" ascii
        $pubkey_b64 = "HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM=" ascii
        $ransom_note_go = "README-GENTLEMEN.txt" ascii
        $ransom_note_c = "!-READ-ME---GEN-TLE-MEN-!.txt" ascii
        $deploy_gpo = "deploy_gpo.ps1" ascii
        $wmi_uuid = "SELECT UUID FROM Win32_ComputerSystemProduct" ascii
        $json_name = "\"name\"" ascii
        $json_domain = "\"domain\"" ascii
        $json_uuid = "\"uuid\"" ascii
        $json_localips = "\"localIPs\"" ascii
        $gpo_update = "gPCMachineExtensionNames" ascii
        $sched_task_user = "UpdateUser" ascii
        $sched_task_system = "TaskSystem" ascii
        $run_key = "GupdateS" ascii
        $psexec_url = "live.sysinternals" ascii
        $rsat_cap = "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" ascii
        $netsh_trace = "netsh trace start capture=yes" ascii

    condition:
        3 of them
}

Sigma rule

title: The Gentlemen Ransomware TTPs - Defence Evasion and Persistence
id: 8f3a2c1d-4b5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: >
    Detects defence evasion, persistence, and lateral movement techniques
    associated with The Gentlemen ransomware (Storm-2697), including
    Windows Defender disabling via registry and PowerShell, BYOVD driver
    loading, scheduled task creation for persistence, shadow copy deletion,
    event log clearing, and GPO-based propagation.
references:

    - https://securelist.com/the-gentlemen-raas/120447/
    - https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/
author: Adverse Trace
date: 2026/06/29
logsource:
    product: windows
    category: process_creation
detection:
    selection_defender_ps:
        CommandLine|contains|all:

            - "Set-MpPreference"
            - "-DisableRealtimeMonitoring $true"
    selection_defender_exclusion:
        CommandLine|contains:

            - "Add-MpPreference -ExclusionPath 'C:\\'"
            - "Add-MpPreference -ExclusionProcess"
    selection_defender_cfa:
        CommandLine|contains|all:

            - "Set-MpPreference"
            - "-EnableControlledFolderAccess Disabled"
    selection_schtasks_persistence:
        CommandLine|contains|all:

            - "schtasks"
            - "/Create"
            - "UpdateUser"
    selection_schtasks_system:
        CommandLine|contains|all:

            - "schtasks"
            - "/create"
            - "TaskSystem"
    selection_run_key:
        CommandLine|contains|all:

            - "reg.exe add"
            - "GupdateS"
            - "CurrentVersion\\Run"
    selection_vssadmin:
        CommandLine|contains|all:

            - "vssadmin.exe delete shadows /all /quiet"
    selection_wevtutil:
        CommandLine|contains|all:

            - "wevtutil.exe cl"
    selection_netsh_trace:
        CommandLine|contains:

            - "netsh trace start capture=yes"
    selection_psexec_download:
        CommandLine|contains:

            - "Invoke-WebRequest"
            - "PsExec.exe"
    selection_rsat_install:
        CommandLine|contains:

            - "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"
    selection_gpo_update:
        CommandLine|contains:

            - "gpupdate /force"
    selection_stop_vm:
        CommandLine|contains:

            - "Stop-VM -Force -TurnOff"
    selection_taskkill:
        CommandLine|contains:

            - "taskkill.exe"
    selection_deploy_gpo:
        CommandLine|contains:

            - "deploy_gpo.ps1"
    selection_kavrmvr:
        CommandLine|contains:

            - "kavrmvr.exe"
    condition: 1 of selection_*
falsepositives:

    - Legitimate administrative activity (gpupdate, netsh trace, RSAT installation)
    - Security tooling testing
level: high

7. Sources

• Kaspersky (Securelist) — "The Gentlemen RaaS: rapid growth and a new ransomware variant" — https://securelist.com/the-gentlemen-raas/120447/ — 2026-06-29
• Microsoft Threat Intelligence — "The Gentlemen ransomware: Dissecting a self-propagating Go encryptor" — https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/ — 2026-05-28
• Krebs on Security — "Who Runs the Ransomware Group 'The Gentlemen?'" — https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/ — 2026-06
• DataBreaches.net — "Who Runs the Ransomware Group 'The Gentlemen?'" — https://databreaches.net/2026/06/10/who-runs-the-ransomware-group-the-gentlemen/ — 2026-06-10
• BleepingComputer — "Gentlemen ransomware uses multiple EDR killers to disable defenses" — https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/ — 2026

8. Adverse Trace position

This is a high-severity threat for EMEA financial services. The Gentlemen explicitly target financial services, operate a RaaS with a 90/10 revenue split accelerating affiliate recruitment, and combine rapid domain-wide propagation (GPO + PsExec) with double extortion. The Go backdoor deployed 24 hours before encryption provides a detection window — if the C2 at 81.177.215.15:9443 is observed, there is approximately 24 hours to contain before encryption begins. The C variant in development indicates the group is investing in capability expansion. Attribution to "The Gentlemen" is multi-vendor corroborated (Kaspersky, Microsoft, Check Point, BleepingComputer) but the actor name has no MITRE ATT&CK profile in verified reference data — we treat attribution as unconfirmed. The real-world identity claim (Krebs / Constella / Intel 471) is single-sourced; verify before enforcement. We will continue monitoring for the C variant maturation, new C2 infrastructure, and additional driver abuse. Clients should prioritise P1 actions immediately, particularly C2 blocking and backdoor hunting.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.