The ransomware landscape continues to evolve at a rapid pace, and one of the most notable emerging threats in 2026 is “The Gentlemen”, a ransomware-as-a-service (RaaS) group that has quickly risen through the ranks of cybercriminal operations. A recent DFIR (Digital Forensics and Incident Response) investigation by Check Point Research provides rare insight into how this group operates, scales, and compromises enterprise environments.
This blog breaks down the technical anatomy, operational model, and security implications of this growing threat.
The Rise of a Ransomware Powerhouse
“The Gentlemen” first appeared in mid-2025 and rapidly expanded its footprint. Within months, the group claimed over 320 victims, with the majority of attacks occurring in 2026 alone.
What makes this growth particularly notable is not groundbreaking malware innovation—but rather a highly effective business model. The group offers affiliates up to 90% of ransom payments, significantly higher than the typical 70–80% seen in other RaaS programs.
This aggressive revenue-sharing model has attracted experienced cybercriminals, enabling rapid scaling and increasing the sophistication of attacks.
Attack Chain Breakdown: From Access to Encryption
The DFIR investigation reveals a structured, multi-stage attack chain used by affiliates:
Initial Access and Domain Control
The exact initial entry point remains unknown. However, the earliest confirmed activity shows the attacker operating on a Domain Controller with Domain Admin privileges. From this position, they conducted systematic credential validation and host discovery. This is evidenced by a sequence of failed network logons followed by successful authentications originating from the Domain Controller. This pattern suggests a controlled effort to verify privileged access and identify reachable systems before expanding further.
Remote Execution and Early Discovery
Using elevated privileges, the attacker deployed Cobalt Strike payloads to remote systems via administrative shares (e.g., \\HOST\ADMIN$\random.exe) and executed them through RPC. The first deployment occurred on an internal endpoint, followed by similar activity across multiple hosts.
Initial reconnaissance included commands such as:
systeminfowhoami- directory enumeration (
dir c:\users)
The attacker also accessed internal documentation from network shares, indicating both automated discovery and environment-specific knowledge. Repeated execution of tools like regsvr32.exe across systems confirms centralized control.
Command-and-Control and Payload Staging
The attacker attempted to establish command-and-control (C2) channels using multiple methods. A SystemBC variant (socks.exe) was deployed to create a SOCKS proxy for covert communication, though this attempt was blocked.
Subsequently, another payload successfully established outbound communication with a Cobalt Strike C2 server over ports 443 and 80.
At the same time, a PowerShell command executed via a scheduled task downloaded a ransomware payload (grand.exe) from an internal server and ran it with arguments enabling both execution and propagation. This marked the transition from reconnaissance to active malware deployment.
Defense Evasion, Propagation, and Persistence
The attacker disabled Microsoft Defender using PowerShell to avoid detection. The same ransomware payload appeared across multiple systems under different filenames, demonstrating rapid propagation.
Additional actions included:
- Checking for security software (e.g., Kaspersky)
- Forcing Group Policy updates (
gpupdate /force) - Enabling Remote Desktop
- Installing and configuring AnyDesk for persistent remote access
These steps established multiple fallback access mechanisms and ensured continued control.
Credential Access and Ongoing Discovery
Credential harvesting tools such as Mimikatz were used to extract sensitive information, including domain credentials.
Simultaneously, the attacker performed extensive domain enumeration:
- Active sessions (
query session) - Domain trusts (
nltest) - Domain controllers
- Privileged groups (Domain Admins, Enterprise Admins)
This indicates a shift toward full domain awareness and control.
Consolidated Intrusion Overview
Overall, the attack progressed through the following stages:
- Initial access (likely external)
- Escalation to Domain Admin privileges
- Credential validation and reconnaissance
- Lateral movement via ADMIN$ shares
- Deployment of Cobalt Strike and other payloads
- Establishment of C2 channels
- Malware staging and propagation
- Defense evasion and persistence
The attacker demonstrated adaptability, switching techniques when blocked (e.g., abandoning SystemBC in favor of alternative C2 channels). The operation was centrally coordinated and resulted in widespread compromise.
Impact
The attack culminated in the deployment of The Gentlemen RaaS ransomware via Group Policy. By leveraging a GPO-based mechanism, the ransomware executed across all domain-joined systems during policy refresh, leading to rapid, simultaneous encryption across the environment.
Infrastructure and Communication Tactics
The Gentlemen demonstrate a mature operational infrastructure:
- Onion-based leak sites for publishing stolen data
- Use of Tox messaging protocol for negotiations (peer-to-peer encrypted communication)
- Public shaming via social platforms to pressure victims
Unlike centralized negotiation portals, decentralized communication reduces traceability and improves operational resilience.
Global Impact and Targeted Industries
The group primarily targets:
- Manufacturing
- Technology
- Healthcare
Their willingness to attack healthcare organizations is particularly concerning, as some ransomware groups traditionally avoid this sector.
Geographically, victims are concentrated in:
- United States
- United Kingdom
- Germany
Additionally, investigations linked over 1,570 infected systems to SystemBC infrastructure, highlighting the scale of operations.
Security Implications for Organizations
The emergence of The Gentlemen reinforces several critical lessons for cybersecurity teams:
- Ransomware is now business-driven rather than purely technical
- Initial access prevention is critical, especially around credential theft and lateral movement
- Monitoring for proxy malware like SystemBC is essential
- Network segmentation and least privilege access can limit domain-wide compromise
- Incident response readiness is no longer optional
With global cyberattacks averaging nearly 2,000 per organization weekly, the threat landscape remains persistently high.
Our Opinion: What This Case Really Means
The Gentlemen case highlights a critical shift in cybersecurity—from technical sophistication to operational efficiency and monetization strategy. What stands out is not the novelty of their tools, but how effectively they package and distribute them.
In many ways, ransomware groups are now behaving like startups: optimizing revenue models, improving user (affiliate) experience, and scaling rapidly through incentives. The 90% affiliate payout is a clear example of how economic factors can reshape the threat landscape faster than technological innovation.
This also exposes a gap in traditional cybersecurity thinking. Organizations often focus on malware signatures or zero-day exploits, while attackers are winning through process optimization, automation, and human-driven intrusion workflows.
Another concerning takeaway is the normalization of attacks on sensitive sectors like healthcare. This suggests that ethical boundaries in cybercrime are eroding further, increasing real-world risk beyond financial damage.
Ultimately, defending against groups like The Gentlemen requires a mindset shift: from reactive security to proactive resilience. Detection, response, and containment strategies must evolve to match the speed and scale of modern ransomware operations.
Organizations that fail to adapt to this new reality risk becoming easy targets in an increasingly industrialized cybercrime ecosystem.
Indicators of Compromise
| Description | Value |
|---|---|
| Cobalt Strike C&C | 91.107.247[.]163 |
| SystemBC | 992c951f4af57ca7cd8396f5ed69c2199fd6fd4ae5e93726da3e198e78bec0a5 |
| SystemBC C&C | 45.86.230[.]112 |
| The Gentlemen Windows | 025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67 2ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d 3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235 48d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd 62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb8 860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba431158923 87d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c 8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db 91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1 994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e3 9f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454 a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0ad b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6 c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8 c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73 ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2 efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108f f736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12 fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958 |
| Embedded binaries (psexesvc.exe/psexec.exe) | cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b |
| gentlemen.bmp | fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68 |
| The Gentlemen Linux | 5dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca 788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19 1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c |
MITRE ATT&CK Matrix
| Tactic | Technique / Sub‑Technique | Description |
|---|---|---|
| Initial Access | Valid Accounts (T1078) | Attacker already active on Domain Controller with Domain Admin privileges; --spread "domain\\user:password" uses harvested domain credentials for remote execution and lateral movement. |
| Initial Access | External Remote Services (T1133) (inferred) | Initial entry not directly observed; context suggests possible compromise via exposed remote services (e.g., RDP/VPN), but campaign evidence starts post‑compromise on DC. |
| Execution | Command Shell (T1059.003) | Widespread cmd.exe /C usage: systeminfo, whoami, dir c:\\users, type \\\\host\\share\\file.txt, taskkill, gpupdate /force, net, rd, etc. |
| Execution | PowerShell (T1059.001) | Defender tampering and firewall changes via PowerShell; internal HTTP download of grand.exe to c:\\programdata\\r.exe; extensive script‑based lateral movement using Invoke-Command and multi‑step PowerShell scripts (SCRIPT_A…SCRIPT_G). |
| Execution | Windows Management Instrumentation (T1047) | wmic /node:<target> process call create "<DEFENDER_SCRIPT_A>" and wmic ... "C:\\Temp\\<exe> <creds>" to execute scripts and lockers on remote hosts. |
| Execution | Scheduled Task/Job: Scheduled Task (T1053.005) | Creation of local and remote tasks: UpdateSystem, UpdateUser, DefU, DefS, UpdateGU, UpdateGU2, UpdateGS, UpdateGS2 using schtasks /Create /S <target> ... /Run for execution and persistence. |
| Execution | System Services: Service Execution (T1569.002) | Remote services DefSvc, UpdateSvc, UpdateSvc2 created and started via sc \\\\<target> create ... and sc \\\\<target> start ... to run ransomware or helper scripts. |
| Execution | Native API (T1106) | Use of SystemParametersInfoW to set gentlemen.bmp as wallpaper; dynamic loading of mpr.dll and calls to WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum to enumerate network shares. |
| Execution | User Execution: Malicious File (T1204.002) | Operator‑driven execution of ransomware payloads (r.exe, g.exe, o.exe, GPO‑deployed locker) on endpoints as final stage of intrusion. |
| Persistence | Scheduled Task/Job: Scheduled Task (T1053.005) | Local persistence via schtasks /Create /SC ONSTART /TN UpdateSystem /TR "<exe> <args>" /RU SYSTEM; remote tasks on many hosts ensure repeated execution and durability of the locker. |
| Persistence | Registry Run Keys / Startup Folder (T1060) | Run key added: reg add HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v GupdateU /t REG_SZ /d "<exe>" /f to autostart ransomware in user context. |
| Persistence | Create or Modify System Process: Windows Service (T1543.003) | Creation of new services (DefSvc, UpdateSvc, UpdateSvc2) on remote hosts to execute ransomware or helper logic, typically running as SYSTEM. |
| Persistence | Boot or Logon Autostart Execution: rc.local (T1547.009) | ESXi/Linux variant copies itself to /bin/.vmware-authd and configures /etc/rc.local.d/local.sh with sleep 30 && /bin/.vmware-authd <original_argv> & to auto‑run on boot. |
| Persistence | Scheduled Task/Job: Cron (T1053.003) | ESXi variant adds cron entry @reboot sleep 60 && /bin/.vmware-authd <original_argv> via crontab -, providing additional boot persistence. |
| Persistence | Boot or Logon Initialization Scripts (T1037.004) | Combined use of rc.local (/etc/rc.local.d/local.sh) and cron @reboot scripts ensures the locker relaunches after ESXi host reboot. |
| Persistence | Ingress Tool Transfer (T1105) | --gpo deployment mode copies locker to \\\\<domain>\\NETLOGON\\<exe> and injects ScheduledTasks.xml into GPO path; all domain machines then pull and execute the locker via GPO‑scheduled tasks. |
| Privilege Escalation | Valid Accounts (T1078) | Stolen Domain Admin and other domain credentials used with PsExec (-u <domain\\user> -p <pass>) and --spread to perform privileged remote execution and lateral movement. |
| Privilege Escalation | Scheduled Task/Job: Scheduled Task (T1053.005) | Tasks created to run as SYSTEM (/RU SYSTEM) – locally and via GPO – escalate from user to LocalSystem context for file encryption and defense evasion. |
| Privilege Escalation | Create or Modify System Process: Windows Service (T1543.003) | Attackers create new services configured to run under high‑privilege service accounts (usually SYSTEM) on remote hosts to execute ransomware components. |
| Defense Evasion | Impair Defenses: Disable or Modify Tools (T1562.001) | Defender disabled and neutered via Set-MpPreference -DisableRealtimeMonitoring $true; exclusions added for C:\\, C:\\Temp, \\\\<host>\\share$, and the ransomware process; these operations are performed locally and remotely via scripts. |
| Defense Evasion | Impair Defenses: Disable or Modify System Firewall (T1562.004) | Firewall disabled globally: netsh advfirewall set allprofiles state off, Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False; firewall service mpssvc is stopped and set to disabled. |
| Defense Evasion | Impair Defenses: Disable or Modify Cloud/Network Security (T1562.007) | Attackers enable SMB1 (Enable-WindowsOptionalFeature ... SMB1Protocol), loosen LSA anonymous access (EveryoneIncludesAnonymous=1, RestrictAnonymous=0), and set open network shares using net share + icacls, reducing network/segmentation protections. |
| Defense Evasion | Indicator Removal on Host: Clear Windows Event Logs (T1070.001) | wevtutil cl System, wevtutil cl Application, wevtutil cl Security executed to remove Windows event logs and hinder forensic reconstruction. |
| Defense Evasion | Indicator Removal on Host: File Deletion (T1070.004) | Forensic artefacts removed: prefetch (C:\\Windows\\Prefetch\\*.*), Defender logs (C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*), RDP logs (%SystemRoot%\\System32\\LogFiles\\RDP*\\*.*), $Recycle.Bin, plus overwriting free space via wipefile.tmp with 64 MB chunks. |
| Defense Evasion | Indicator Removal on Host: Timestomp (T1070.006) (implied) | Report notes --silent avoids file renaming and timestamp changes; default behavior implied to alter names/timestamps, hampering timeline reconstruction and signature‑based detection. |
| Defense Evasion | Masquerading: Masquerade Task or Service (T1036.004) | ESXi locker placed at /bin/.vmware-authd, masquerading as legitimate VMware vmware-authd daemon. |
| Defense Evasion | Masquerading: Match Legitimate Name or Location (T1036.005) | Ransomware components use generic names (r.exe, g.exe, o.exe) and common locations (C:\\ProgramData\\, C:\\Temp\\, admin shares) to blend with normal tools and admin activity. |
| Defense Evasion | Hide Artifacts: Hidden Window / Binary (T1564.003) | ESXi binary uses a leading dot .vmware-authd to stay hidden; --silent mode on Windows avoids visible UI changes like wallpaper and renaming, running ransomware quietly in the background. |
| Defense Evasion | Obfuscated/Encrypted Artifacts (T1027) | Per‑file ephemeral X25519 keys and XChaCha20 encryption plus footer markers (`–eph–<base64_ephemeral_pubkey>–marker–GENTLEMEN\nGENTLEMEN[–fast |
| Credential Access | OS Credential Dumping (T1003) | Mimikatz artefacts recovered from memory show dumping of domain credentials and stored secrets from compromised workstations. |
| Credential Access | Credentials from Password Stores (T1555) | Mimikatz dumping likely includes passwords from Windows Credential Manager/password stores, used later for --spread and PsExec. |
| Discovery | System Information Discovery (T1082) | cmd.exe /C systeminfo run on compromised hosts to gather OS and hardware information. |
| Discovery | Account Discovery (T1033) | cmd.exe /C whoami to confirm identity and context on multiple hosts. |
| Discovery | Account Discovery: Domain Account (T1087.002) | net group "Domain Admins" /domain and net group "Enterprise Admins" /domain executed to enumerate domain‑level privileged groups. |
| Discovery | Domain Trust Discovery (T1482) | nltest /domain_trusts, nltest /dclist (implied) to identify domain trust relationships and domain controllers. |
| Discovery | Remote System Discovery (T1018) | Domain computers enumerated via Get-ADComputer -Filter *; each host pinged to confirm reachability before executing lateral movement steps. |
| Discovery | Permission Groups Discovery: Domain Groups (T1069.002) | net group "Domain Admins" /domain and similar commands to discover privileged group membership. |
| Discovery | Network Share Discovery (T1135) | mpr.dll dynamically loaded; WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum used to enumerate available network shares after enabling network discovery services. |
| Discovery | File and Directory Discovery (T1083) | cmd.exe /C dir c:\\users; reading internal files (e.g., Chinese language “公司主機紀錄.txt”) on file servers via UNC paths. |
| Discovery | Software Discovery: Security Software Discovery (T1518.001) | wmic product where Name like '%kaspe%' get Name, IdentifyingNumber executed to identify installed Kaspersky (or similar) security products. |
| Discovery | Network Service Scanning (T1046) (partly inferred) | While explicit port scans are not shown, large‑scale multi‑protocol lateral attempts via PsExec, WMI, remote services, and scheduled tasks after pinging hosts imply service reachability probing. |
| Lateral Movement | Remote Services: SMB/Windows Admin Shares (T1021.002) | Payloads dropped to \\\\<hostname>\\ADMIN$\\<random>.exe, \\\\<target>\\C$\\Temp\\<exe>; share share$=C:\\Temp created and ACLs widened via icacls to support anonymous/Everyone access. |
| Lateral Movement | Remote Services: RPC (T1021.001) | Cobalt Strike and subsequent ransomware payloads executed over RPC from the Domain Controller after being copied to admin shares. |
| Lateral Movement | Remote Services & Service Execution (T1021.001 + T1569.002) | psexec \\\\<target> -accepteula -d -s/-h ... for remote execution, along with remote sc create/sc start to run services DefSvc, UpdateSvc*. |
| Lateral Movement | Remote Services: Windows Remote Management (T1021.006) | PowerShell Invoke-Command -ComputerName <target> -ScriptBlock {...} used to disable Defender, set exclusions, and start lockers on remote machines. |
| Lateral Movement | Windows Management Instrumentation (T1047) | wmic /node:<target> process call create "<DEFENDER_SCRIPT_A>" and wmic /node:<target> process call create "C:\\Temp\\<exe> <creds>" to run scripts and lockers remotely. |
| Lateral Movement | Scheduled Task/Job: Scheduled Task (T1053.005) | Remote scheduled tasks (DefU, DefS, UpdateGU*, UpdateGS*) created on numerous hosts and executed with /S <target> and /Run. |
| Lateral Movement | Lateral Tool Transfer (T1570) | Locker copied using xcopy "<exe>" "\\\\<target>\\C$\\Temp\\" /Y /I /C /H /R /K and accessible via \\\\<host>\\share$\\<exe> from remote systems. |
| Lateral Movement | Remote Services: RDP (T1021.001) | RDP access enabled via reg add ...\\Terminal Server /v fDenyTSConnections /d 0 /f and firewall rule enabling “Remote Desktop” group, supporting interactive lateral movement. |
| Lateral Movement | Ingress Tool Transfer (T1105) | Internal HTTP server on DC offers grand.exe on port 8080, fetched via PowerShell downloadfile(...) to c:\\programdata\\r.exe. |
| Command and Control | Proxy: Multi‑hop Proxy (T1090.003) | SystemBC (socks.exe) deployed; attempts outbound C2 to 45.86.230[.]112; acts as encrypted SOCKS proxy for C2 tunneling and pivoting. |
| Command and Control | Ingress Tool Transfer (T1105) | Cobalt Strike payloads and ransomware components transferred via HTTP, SMB (ADMIN$, C$), and NETLOGON share as part of C2 and staging. |
| Command and Control | Application Layer Protocol: Web Protocols (T1071.001) | Cobalt Strike beacon from rundll32.exe to 91.107.247[.]163 using ports 443 and later 80 (HTTPS/HTTP). |
| Command and Control | Encrypted Channel: Asymmetric Cryptography (T1573.002) | Cobalt Strike uses encrypted HTTPS; SystemBC uses RC4‑encrypted tunnel over SOCKS; both provide encrypted C2 channels. |
| Exfiltration | Exfiltration Over C2 Channel (T1041) | Ransom note claims “We have exfiltrated all your confidential and business data (including NAS, clouds, etc.)”; details not shown, but implies data exfiltration via C2/remote access tooling (Cobalt Strike, SystemBC, AnyDesk). |
| Impact (Extortion) | Data Destruction in Extortion (T1654) | Threats of “irreversible wipe of all data and your network” if victim attempts restoration or refuses to negotiate, coupled with timed leak‑site publication. |
| Impact (Extortion) | Financial Theft / Extortion (T1657) | Classic double‑extortion: demands payment for decryption and to prevent public leak; uses Tox IDs, Session, Tor blog tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion, and X account TheGentlemen25. |
| Impact | Data Encrypted for Impact (T1486) | Multi‑OS lockers encrypt data (Windows/Linux/ESXi); for large files only 1–9% (depending on --fast/--superfast/--ultrafast) is encrypted with XChaCha20; per‑file footer includes --eph--<base64>--marker--GENTLEMEN\\nGENTLEMEN[...]--. |
| Impact | Inhibit System Recovery (T1490) | Shadow copies removed via vssadmin delete shadows /all /quiet and wmic shadowcopy delete; $Recycle.Bin removed; logs and prefetch deleted; optional --wipe mode overwrites free space with wipefile.tmp. |
| Impact | Service Stop (T1489) | Services (including firewall mpssvc and likely AV/backup) stopped and disabled via sc stop <service> and sc config <service> start=disabled. |
| Impact | Defacement: Internal Defacement (T1491.001) | Desktop background changed to embedded gentlemen.bmp written to %TEMP% and applied via SystemParametersInfoW, signaling compromise to victims. |
