Unmasking The Gentlemen Ransomware

An analysis of the Gentlemen ransomware group, which employs advanced, adaptive tactics, techniques, and procedure to target critical industries worldwide.

By: Jacob Santos, Maristel Policarpio, Don Ovid Ladores, Junestherry Dela Cruz Sep 09, 2025 Read time: ( words)

In August 2025, we investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities through their systematic compromise of enterprise environments. By adapting their tools mid-campaign—shifting from generic anti-AV utilities to highly targeted, specific variants—the attackers demonstrate versatility and determination, posing a significant threat to organizations regardless of their security defenses.

The campaign’s attack chain exposed several highly sophisticated and concerning tactics. Notably, the threat actor exploited legitimate drivers for defense evasion, abused Group Policy Objects (GPO) to facilitate domain-wide compromise, and deployed custom malicious tools designed to disable security solutions present in the environment. The Gentlemen group demonstrated operational security practices by utilizing encrypted channels for data exfiltration via WinSCP and establishing redundant persistence mechanisms through both AnyDesk remote access software and modified registry settings.

The group's tactics, particularly their development of custom tools targeting specific security vendors, indicates an evolution in ransomware operations where attackers conduct extensive reconnaissance — resulting in tailored bypasses for the defenses they encounter. This approach represents a shift from opportunistic attacks; through systematic analysis of security software documentation, the threat actors combine this knowledge with the abuse of legitimate tools and vulnerable drivers to deploy environment-specific evasion techniques.

The Gentlemen's substantial victim count, coupled with the lack of prior threat intelligence suggests either a rebranding effort by experienced operators or the emergence of a well-funded new entrant within the ransomware ecosystem. By using threat intelligence on the group's methodologies, organizations can proactively identify their tools, tactics, and procedures (TTPs), implement targeted defensive measures, and prepare incident response plans aligned with these observed behaviors.

The Gentlemen ransomware group has been targeting organizations across multiple sectors, with a particular focus on the Asia-Pacific region. The manufacturing industry has been the hardest hit, followed closely by construction, healthcare, and insurance. The group’s attacks on essential services such as healthcare highlights its disregard for critical infrastructure and its potential public safety implications. Key target countries include Thailand and the United States, with a total of 17 countries affected.

Although the exact initial access vector remains unconfirmed for this specific incident, our investigation suggests the threat actors likely exploited internet-facing services or compromised credentials to establish their initial foothold. The presence of network reconnaissance tools (such as Advanced IP Scanner, shown below) early in the attack timeline, combined with evidence of systematic infrastructure mapping, indicates a calculated entry strategy rather than opportunistic exploitation. Following the initial compromise, the attackers carried out thorough reconnaissance via Advanced IP Scanner to gain knowledge of the network layout and identify valuable targets.

C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner.exe

During the discovery phase, the threat actor examined Active Directory structures, focusing on domain administrators, enterprise administrators, and custom privilege groups such as itgateadmin .

One notable technique used by The Gentlemen involved the use of a batch script named 1.bat to perform mass account enumeration, querying more than 60 user accounts across the domain infrastructure:

They also demonstrated extensive environmental awareness by querying local groups, including standard administrative groups and virtualization-specific groups such as VMware, indicating preparation for lateral movement across both physical and virtualized infrastructure components.

The group's initial defense evasion strategy centered on deploying All.exe in conjunction with ThrottleBlood.sys, leveraging a sophisticated technique previously documented in by other researchers in this report . This approach exploits a legitimate signed driver to perform kernel-level manipulation, effectively terminating security software processes by abusing Windows driver functionality. The tool operates by loading the vulnerable driver and using it to kill protected processes that would normally be shielded from termination:

Recognizing the limitations of this initial approach, the threat actors shifted tactics and began conducting detailed reconnaissance of the endpoint protection mechanisms in place. This allowed them to identify specific security controls and tailor their methods accordingly.

, they deployed PowerRun.exe , a legitimate tool frequently abused for privilege escalation. By leveraging PowerRun.exe , the attackers attempted to execute high-privilege operations, aiming to disable or terminate security-related services and processes.

Throughout this phase, the group demonstrated a targeted approach, adapting their techniques to the particular security solutions they encountered rather than relying solely on generic bypass methods.

After gathering sufficient information, the threat actors introduced an enhanced version of their defense evasion tool, Allpatch2.exe . This tool was specifically customized to neutralize key security agent components by targeting and terminating relevant processes. Their ability to modify evasion strategies based on the victim environment’s defenses highlights a high level of sophistication and adaptability.

The threat actors leveraged PsExec for lateral movement, demonstrating proficiency in living-off-the-land techniques. They systematically weakened security controls by modifying critical registry settings that govern authentication and remote access protocols:

To maintain persistent command-and-control (C&C) access, the threat actors relied on AnyDesk , creating a remote access channel resilient to traditional incident response actions. They further expanded their situational awareness by downloading, installing and executing Nmap for comprehensive internal network scanning:

Critically, the Nmap output path revealed the compromise of a FortiGate administrative account, with network scans originating from this privileged context. This suggests the threat actors had compromised critical network security infrastructure, potentially granting them extensive visibility and control over network traffic. Our investigation confirmed that the FortiGate server was directly accessible from the internet, which likely served as the attackers' entry point into the network.

Additional evidence further indicates the possible use of PuTTY for Secure Shell (SSH)-based lateral movement, though the full scope of this tool's usage remains unclear.

We’ve also observed the use of Group Policy Management Console (gpmc.msc) and Group Policy Management Editor (gpme.msc), likely as part of an attempt to deploy malicious configurations across the domain:

The attacker also executed encoded PowerShell to identify critical domain infrastructure, with a particular focus on the Primary Domain Controller for potential high-impact operations:

This level of Active Directory manipulation indicates preparation for domain-wide ransomware deployment or the establishment of persistent backdoor installation through GPO abuse.

The data staging portion of operation suggests what appears to be a methodical approach to information gathering. We found evidence suggesting possible data consolidation in C:\ProgramData\data , with hundreds of files being accessed. The presence of zone identifier streams could also indicate advanced collection methods, though alternative explanations cannot be ruled out:

We observed several WebDAV connections to several internal resources throughout the compromise period. While these connections could potentially indicate an alternative data collection mechanism or preparation for distributed exfiltration, we would also like to note that WebDAV activity can also occur through legitimate business operations. Within the broader context of the compromise, however, these connections warrant scrutiny:

Even though the timing and volume of these activities align with typical data staging behaviors observed in ransomware attacks, we present this analysis with moderate confidence pending additional forensic validation.

Data exfiltration was likely carried out through WinSCP , a legitimate file transfer tool commonly abused by threat actors for its reliability and encryption capabilities. Our telemetry shows the transfer of sensitive internal documentation:

The choice of WinSCP suggests the attackers prioritized operational security, using encrypted channels to avoid detection by network monitoring solutions.

The ransomware was deployed throughout the domain's NETLOGON , ensuring widespread distribution across all domain-joined systems. The payload was password-protected, likely to evade automated sandbox analysis:

Prior to encryption, the built-in Windows Defender was neutralized through PowerShell commands:

To ensure persistent access for negotiation and additional extortion activities, the following firewall rules were modified:

Overall, the campaign highlights the threat actors' understanding of enterprise security architectures, demonstrated through adaptive countermeasures specifically tailored to overcome deployed security solutions, systematic data theft for double extortion, and the eventual successful deployment of ransomware using domain administrator privileges for maximum impact.

The ransomware drops the following ransom note and appends the following extension:

In terms of execution, the ransomware accepts specific parameters:

The ransomware aggressively attempts to terminate key services commonly associated with backup, database, and security processes to maximize its impact:

net stop (.*)sql(.*), AcrSch2Svc, VSNAPVSS, MVarmor64, MVarmor, VeeamTransportSvc, VeeamDeploymentService, VeeamNFSSvc, AcronisAgent, QBIDPService, QBDBMgrN, QBCFMonitorService, OracleServiceORCL, MySQL, MSSQL, SAPHostExec, SAPHostControl, SAPD$, SAP$, postgresql, SAP, SAPService, GxFWD, GxVsshWProv, GXMMM, GxClMgr, MariaDB, GxCVD, GxClMgrS, GxVss, GxBlr, BackupExecRPCService, SQLAgent$SQLEXPRESS, BackupExecManagementService, BackupExecJobEngine, MSSQL$SQLEXPRESS, BackupExecDiveciMediaService, BackupExecAgentBrowser, SQLWriter, BackupExecAgentAccelerator, BackupExecVSSProvider, PDVFSService, SQLSERVERAGENT, WSBExchange, MSExchange\$, MSExchange, sophos, msexchange, docker, MSSQLSERVER, MSSQL*, Sql, vss, backup, veeam, memtas, mepocs, vmms

Further, the threat systematically terminates processes using the following commands:

taskkill /IM .exe /F Veeam.EndPoint.Service.exe, mvdesktopservice.exe, VeeamDeploymentSvc.exe, VeeamTransportSvc.exe, VeeamNFSSvc.exe, EnterpriseClient.exe, DellSystemDetect.exe, avscc.exe, avagent.exe, sapstartsrv.exe, saposco.exe, saphostexec.exe, CVODS.exe, cvfwd.exe, cvd.exe, CVMountd.exe, tv_x64.exe, tv_w32.exe, pgAdmin4.exe, TeamViewer.exe, TeamViewer_Service.exe, SAP.exe, QBCFMonitorService.exe, pgAdmin3.exe, QBDBMgrN.exe, QBIDPService.exe, CagService.exe, vsnapvss.exe, raw_agent_svc.exe, cbInterface.exe, "Docker Desktop.exe", beserver.exe, pvlsvr.exe, bengien.exe, benetns.exe, vxmon.exe, bedbh.exe, IperiusService.exe, sqlceip.exe, xfssvccon.exe, wordpad.exe, winword.exe, visio.exe, thunderbird.exe, thebat.exe, Iperius.exe, psql.exe, postgres.exe, tbirdconfig.exe, synctime.exe, steam.exe, sqbcoreservice.exe, powerpnt.exe, cbVSCService11.exe, postmaster.exe, mysqld.exe, outlook.exe, oracle.exe, onenote.exe, ocssd.exe, ocomm.exe, ocautoupds.exe, SQLAGENT.exe, sqlwriter.exe, notepad.exe, mydesktopservice.exe, mydesktopqos.exe, mspub.exe, msaccess.exe, cbService.exe, sqlbrowser.exe, w3wp.exe, sql.exe, isqlplussvc.exe, infopath.exe, firefox.exe, excel.exe, encsvc.exe, Ssms.exe, DBeaver.exe, sqlservr.exe, dbsnmp.exe, dbeng50.exe, agntsvc.exe, vmcompute.exe, vmwp.exe, vmms.exe

Beyond service and process termination, the ransomware executes additional commands to impede recovery and forensic investigation:

For final cleanup, the ransomware drops a batch script named after itself (e.g., {filename}.exe.bat ). This script pings the local host for a brief delay, deletes the ransomware binary, and then deletes itself. This ensures comprehensive removal of its artifacts after the encryption routine is complete.

The Gentlemen ransomware campaign shows the rapid evolution of modern ransomware threats, blending advanced technical sophistication with persistent, targeted operations. This campaign is distinguished by its use of custom-built tools for defense evasion, its ability to study and adapt to deployed security software, and its methodical abuse of both legitimate and vulnerable system components to subvert layered enterprise defenses. By tailoring their tactics against specific security vendors, The Gentlemen have demonstrated an acute awareness of their targets’ environments and a willingness to engage in in-depth reconnaissance and tool modification throughout the course of their operation.

The campaign’s impact on critical infrastructure and use of double extortion techniques underscores the significant risk this threat actor poses to organizations. Their campaign illustrates the growing trend among ransomware operators to move beyond “one-size-fits-all” methods and toward highly customized attacks, raising the bar for detection, prevention, and incident response.

Organizations are strongly advised to review their security posture, focusing on proactive threat hunting for group-specific tools, tactics, and procedures, the strengthening of endpoint and network protections, and the continuous refinement of incident response strategies. Particular attention should be given to monitoring for anomalous administrative activity, the abuse of legitimate tools for lateral movement and privilege escalation, and early indications of defense evasion efforts targeting security solutions.

Given the group's exploitation of internet-facing infrastructure and VPN appliances, Zero Trust controls are essential for preventing initial access and limiting blast radius. Organizations must eliminate direct RDP exposure to the internet, enforce multi-factor authentication for all administrative interfaces, and implement network segmentation between IT management tools and production systems. Enterprises should also implement virtual patching for known vulnerabilities in perimeter devices, particularly VPN concentrators and firewalls that THE GENTLEMEN has been observed targeting.

Essential access controls and monitoring include:

The immediate priority is hardening endpoint security deployments against the group's documented process termination techniques. Organizations using Trend solutions should enable Tamper Protection with Anti-exploit Protection to prevent custom tools from terminating critical security processes. Additionally, password-protect agent uninstallation and activating Agent Self-Protection alongside Predictive Machine Learning in both pre-execution and runtime modes. These configurations specifically counter the group's attempts to disable security services before ransomware deployment.

Critical endpoint controls should include:

Trend Vision One️™ is the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management, security operations, and robust layered protection. This holistic approach helps enterprises predict and prevent threats, accelerating proactive security outcomes across their respective digital estate. With Trend Vision One, you’re enabled to eliminate security blind spots, focus on what matters most, and elevate security into a strategic partner for innovation.

To stay ahead of evolving threats, Trend customers can access Trend Vision One™ Threat Insights , which provides the latest insights from Trend™ Research on emerging threats and threat actors.

Trend Vision One customers can use the App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.

eventSubId: 106 AND processCmd: /--password\s+(\w{8})\b/ AND objectFilePath: .7mtzhh

eventSubId: 101 AND processCmd: /--password\s+(\w{8})\b/ AND objectFilePath: README-GENTLEMEN.txt

More hunting queries are available for Trend Vision One customers with Threat Insights Entitlement enabled .