Researchers discovered an unauthenticated open directory on a Russian bulletproof hosting provider containing a complete ransomware operator toolkit attributed to a TheGentlemen ransomware affiliate. The toolkit includes legitimate utilities, well‑known offensive tools, batch scripts for defense evasion, credential dumping, and remote access, as well as cleartext ngrok tokens. Evidence such as Mimikatz logs confirms active use against real victims.
The investigation began by querying previously published IOCs, leading to the open directory at 176.120.22.127:80. Analysts catalogued 126 files, extracted network scanning tools, privilege escalation utilities, defender disabling scripts, credential dumping logs, and persistence mechanisms. Detailed analysis mapped each component to MITRE ATT&CK techniques and highlighted the layered defense‑evasion approach.
Defenders should monitor for execution of known dual‑use tools, registry changes disabling Windows Defender, mass service termination, VSS shadow deletion, and creation of open SMB shares. Blocking outbound connections to the identified IP and ngrok infrastructure, and enforcing application whitelisting and credential guard can reduce impact.
Upon detection, isolate the affected host, collect volatile data, and identify any active ngrok tunnels using the exposed tokens. Remediate registry modifications, restore disabled services, and initiate full incident response procedures including credential rotation and backup restoration.
## Simulation Environment & Context
TTP Context & Relevance: The rule targets the execution of binaries historically associated with the listed techniques (e.g., mimikatz for T1003.001, ngrok for T1572, RustDesk for T1219). By reproducing these executions we can validate whether the detection fires as intended and assess how renaming or alternative tooling affects detection.
## Telemetry & Baseline Pre‑flight Check
Rationale: Before simulating the attack, we must confirm that the target host is configured to generate the necessary logs, that these logs are ingested by the SIEM, and that the detection rule does not fire on benign activity. Without this validation, any test outcome is unreliable.
1. Telemetry Configuration Instructions:
2. Ingestion & Baseline Validation:
Action (Benign Telemetry): Execute a common Windows binary that is not part of the detection list but still generates a process‑creation event.
Validation Query (Ingestion): Confirm the Notepad event appears in the SIEM.
## Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands:
Each of these executions produces a Sysmon/Event 4688 record with the Image field ending in the respective executable name, satisfying the detection condition.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
