The Gentlemen Ransomware: RaaS Tactics and Tools

The Gentlemen is a Russian-speaking Ransomware-as-a-Service (RaaS) group that emerged in mid-2025 after previously operating as an affiliate of LockBit and Qilin. The group follows a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site. Its operations target Windows, Linux, NAS, and BSD environments using Go-based ransomware.

Acronis researchers analyzed a breach of The Gentlemen’s infrastructure that exposed internal communications, affiliate information, and discussions related to tool development. Technical analysis uncovered custom EDR-killing droppers that abuse vulnerable drivers to terminate security processes. Researchers also mapped the group’s encryption routines, persistence methods, and lateral movement activity involving PsExec.

Organizations should deploy EDR/XDR solutions capable of identifying security tool tampering and unauthorized driver loading. Keeping operating systems and third-party drivers fully updated is critical to reducing abuse of vulnerable kernel drivers. Restricting PowerShell usage and maintaining isolated, regularly tested backups are also strongly recommended.

When The Gentlemen activity is detected, incident responders should immediately isolate affected systems to prevent lateral movement through PsExec or automated propagation. Investigate unauthorized scheduled tasks and registry Run keys such as GupdateS and GupdateU to disrupt persistence. Review Windows Event Logs and PowerShell history for evidence of artifact removal and forensic evasion.

Attack Narrative & Commands: The adversary has gained initial access and is preparing the environment for a ransomware deployment by “The Gentlemen” group. To ensure maximum impact and prevent interference, the attacker executes a series of commands to: 1) Terminate any running user applications, 2) Stop critical services, 3) Create a persistence mechanism via a scheduled task, and 4) Modify permissions on a target directory to ensure the encryption process has full control. This simulation uses the exact strings specified in the detection rule to verify the rule triggers.

Attack Narrative & Commands: The adversary has gained initial access and is preparing the environment for a ransomware deployment by “The Gentlemen” group. To ensure maximum impact and prevent interference, the attacker executes a series of commands to: 1) Terminate any running user applications, 2) Stop critical services, 3) Create a persistence mechanism via a scheduled task, and 4) Modify permissions on a target directory to ensure the encryption process has full control. This simulation uses the exact strings specified in the detection rule to verify the rule triggers.

Regression Test Script: # Simulation script to trigger the Gentlemen Ransomware detection rule Write-Host "[+] Starting Ransomware Simulation..." -ForegroundColor Cyan # 1. Trigger selection1 & selection2 (Process Termination) Write-Host "[+] Triggering Taskkill detection..." -ForegroundColor Yellow Start-Process "taskkill.exe" -ArgumentList "/F /IM explorer.exe" -Wait # 2. Trigger selection3 (Service Stop) Write-Host "[+] Triggering Net Stop detection..." -ForegroundColor Yellow Start-Process "net.exe" -ArgumentList "stop Spooler" -Wait # 3. Trigger selection4 (Persistence) Write-Host "[+] Triggering Schtasks detection..." -ForegroundColor Yellow Start-Process "schtasks.exe" -ArgumentList "/Create /TN UpdateSystem /TR 'calc.exe' /SC ONCE /ST 00:00" -Wait # 4. Trigger selection5 (Permission Changes) Write-Host "[+] Triggering Icacls detection..." -ForegroundColor Yellow New-Item -Path "$env:TEMPRansomSim" -ItemType Directory -Force | Out-Null Start-Process "icacls.exe" -ArgumentList "$env:TEMPRansomSim /grant:r everyone:F" -Wait Write-Host "[+] Simulation Complete." -ForegroundColor Green

Regression Test Script:

Cleanup Commands: # Cleanup script to remove artifacts created during simulation Write-Host "[+] Cleaning up simulation artifacts..." -ForegroundColor Cyan schtasks /Delete /TN UpdateSystem /F Remove-Item -Path "$env:TEMPRansomSim" -Recurse -Force Write-Host "[+] Cleanup Finished." -ForegroundColor Green

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.