Inside The Gentlemen’s Attack Chain and Tradecraft

Summary

The Gentlemen is a sophisticated ransomware group that emerged in August 2025. The operators combine legitimate administrative tools with Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques to disable security software and deploy ransomware across entire domains. Their operations emphasize rapid lateral movement, widespread encryption, and large-scale data extortion.

Investigation

The investigation reconstructed an attack chain beginning with initial access through exposed firewall interfaces, followed by network discovery using Advanced IP Scanner. Analysts observed PowerRun.exe being used for privilege escalation and the ThrottleBlood.sys driver for defense evasion. The group also abused the NETLOGON share to distribute ransomware payloads rapidly across compromised environments.

Mitigation

Organizations should secure internet-facing services such as VPNs and FortiGate interfaces through strong authentication and timely patching. Security teams should monitor for unauthorized additions to privileged Windows groups and restrict unnecessary access to administrative shares including NETLOGON and SYSVOL. Strong backup protections and tighter control over administrative tools can further reduce ransomware risk.

Response

If The Gentlemen activity is detected, responders should immediately identify the account used for privilege escalation and trace its subsequent authentication activity. Affected hosts should be isolated, and analysts should investigate process chains responsible for unauthorized net add commands. Suspicious administrative changes should also be compared with approved change management records to confirm malicious activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary, mimicking “The Gentlemen” group, targets a FortiGate appliance via a known vulnerability. Upon gaining access, the attacker executes a series of commands to establish persistence. To trigger the specific (and weak) detection logic, the attacker performs an action that generates a log entry containing the string “FortiGate”. This mimics the footprint of an attacker interacting with the device’s internal management plane to modify access control lists.

• Regression Test Script:

  # Simulate a log entry that would trigger the 'FortiGate' keyword detection
  # This mimics an attacker triggering a log event through the appliance
  logger -t "FortiGate-System" "Critical: unauthorized access detected on management interface via FortiGate admin portal"

• Cleanup Commands:

  # No persistent changes made to the system; simulation is log-based only.
  # If logs were injected into a database, delete the specific entry:
  # DELETE FROM logs WHERE message LIKE '%FortiGate-System%';