The Gentlemen Ransomware: A Rising Global Cyber Threat

The Gentlemen Ransomware: Targeted Campaign Against Global Critical Sectors

Summary

In August 2025, a new ransomware group known as The Gentlemen emerged, launching highly adaptive, targeted attacks across 17 countries. Their primary focus includes manufacturing, construction, healthcare, insurance, and consumer services, with attacks directed against Windows environments.

The Gentlemen use a combination of legitimate administrative tools, custom anti-AV software, and environment-specific payloads to evade defenses and achieve persistence. Their operations mark an evolution toward methodical, customized ransomware attacks that neutralize security measures, destroy backups, and ensure maximum operational disruption before deploying ransomware.

Attack Details

• Initial Access: Exploitation of internet-exposed services and compromised FortiGate administrative accounts, enabling deep network reconnaissance and lateral movement.

• Living-off-the-Land Techniques: Extensive use of legitimate tools like PowerRun, PsExec, Nmap, PuTTY for privilege escalation and remote control.

• Defense Evasion & Persistence: Abuse of signed drivers, deployment of custom anti-AV utilities, Group Policy manipulation, and registry modifications to maintain stealth.

• Remote Access & Exfiltration: Use of AnyDesk for persistent remote access and WinSCP over encrypted channels for data staging and exfiltration.

• Ransomware Deployment: Distributed through domain NETLOGON shares with password-protected payloads to bypass automated analysis. Actively terminates backup, database, and AV services, deletes logs, and drops ransom notes titled “README-GENTLEMEN.txt”. Files are appended with the .7mtzhh extension, confirming encryption.

This campaign highlights a well-funded and organized ransomware operation, potentially a rebrand of an experienced threat group.

Recommendations

• Harden Privileged Accounts & AD: Apply least privilege, Just-In-Time access, and monitor Group Policy Objects for abnormal changes.

• Block Driver & Tool Abuse: Enforce driver allowlisting and restrict administrative tool usage. Monitor for unauthorized AnyDesk sessions.

• Enhance Endpoint & Network Security: Deploy EDR/XDR, watch for AV tampering, and detect suspicious encrypted file transfers.

• Network Segmentation & DLP: Limit lateral movement opportunities and reduce data exfiltration risks with segmentation and data loss prevention controls.

• Regular Offline Backups: Maintain and test backup integrity frequently to ensure recovery without ransom payment.

Indicators of Compromise (IoCs)

SHA1 Hashes

• c12c4d58541cc4f75ae19b65295a52c559570054

• c0979ec20b87084317d1bfa50405f7149c3b5c5f

• df249727c12741ca176d5f1ccba3ce188a546d28

• e00293ce0eb534874efd615ae590cf6aa3858ba4

Recent Breach Domains

• www.kandeofund.com

• www.pcchandraindia.com:contentReference[oaicite:3]{index=3}

MITRE ATT&CK TTPs

• Initial Access: T1190 (Exploit Public-Facing Applications), T1078 / T1078.002 (Valid & Domain Accounts)

• Execution: T1059 (Command & Scripting Interpreter), T1059.001 (PowerShell), T1059.003 (Windows Command Shell)

• Persistence: T1547 (Boot or Logon Autostart Execution), T1136 (Create Account)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Defense Evasion: T1562 (Impair Defenses), T1112 (Modify Registry), T1027 (Obfuscation), T1484.001 (Group Policy Modification)

• Discovery: T1046 (Network Service Discovery), T1087 / T1087.002 (Account & Domain Account Discovery), T1482 (Domain Trust Discovery)

• Lateral Movement: T1021 (Remote Services), T1021.001 (RDP), T1021.002 (SMB/Windows Admin Shares), T1021.004 (SSH)

• Collection & Exfiltration: T1074 / T1074.001 (Data Staging), T1039 (Data from Network Shared Drive), T1048 / T1048.001 (Exfiltration Over Encrypted Channels)

• Command & Control: T1071 / T1071.001 (Web Protocols), T1219 (Remote Access Software)

• Impact: T1486 (Data Encrypted for Impact), T1489 (Service Stop), T1552 (Unsecured Credentials)

References

• Trend Micro – Unmasking The Gentlemen Ransomware

• Hive Pro – Threat Advisory TA2025277