The Gentlemen Ransomware: Inside a Ransomware-as-a-Service Operation

Summary

The Gentlemen is a Russian-speaking Ransomware-as-a-Service (RaaS) group that emerged in mid-2025 after previously operating as an affiliate of LockBit and Qilin. The group follows a double-extortion model, encrypting victim data while threatening to publish stolen information on a dedicated leak site. Its operations target Windows, Linux, NAS, and BSD environments using Go-based ransomware.

Investigation

Acronis researchers analyzed a breach of The Gentlemen’s infrastructure that exposed internal communications, affiliate information, and discussions related to tool development. Technical analysis uncovered custom EDR-killing droppers that abuse vulnerable drivers to terminate security processes. Researchers also mapped the group’s encryption routines, persistence methods, and lateral movement activity involving PsExec.

Mitigation

Organizations should deploy EDR/XDR solutions capable of identifying security tool tampering and unauthorized driver loading. Keeping operating systems and third-party drivers fully updated is critical to reducing abuse of vulnerable kernel drivers. Restricting PowerShell usage and maintaining isolated, regularly tested backups are also strongly recommended.

Response

When The Gentlemen activity is detected, incident responders should immediately isolate affected systems to prevent lateral movement through PsExec or automated propagation. Investigate unauthorized scheduled tasks and registry Run keys such as GupdateS and GupdateU to disrupt persistence. Review Windows Event Logs and PowerShell history for evidence of artifact removal and forensic evasion.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access and is preparing the environment for a ransomware deployment by “The Gentlemen” group. To ensure maximum impact and prevent interference, the attacker executes a series of commands to: 1) Terminate any running user applications, 2) Stop critical services, 3) Create a persistence mechanism via a scheduled task, and 4) Modify permissions on a target directory to ensure the encryption process has full control. This simulation uses the exact strings specified in the detection rule to verify the rule triggers.

• Regression Test Script:

  # Simulation script to trigger the Gentlemen Ransomware detection rule
  Write-Host "[+] Starting Ransomware Simulation..." -ForegroundColor Cyan
  
  # 1. Trigger selection1 & selection2 (Process Termination)
  Write-Host "[+] Triggering Taskkill detection..." -ForegroundColor Yellow
  Start-Process "taskkill.exe" -ArgumentList "/F /IM explorer.exe" -Wait
  
  # 2. Trigger selection3 (Service Stop)
  Write-Host "[+] Triggering Net Stop detection..." -ForegroundColor Yellow
  Start-Process "net.exe" -ArgumentList "stop Spooler" -Wait
  
  # 3. Trigger selection4 (Persistence)
  Write-Host "[+] Triggering Schtasks detection..." -ForegroundColor Yellow
  Start-Process "schtasks.exe" -ArgumentList "/Create /TN UpdateSystem /TR 'calc.exe' /SC ONCE /ST 00:00" -Wait
  
  # 4. Trigger selection5 (Permission Changes)
  Write-Host "[+] Triggering Icacls detection..." -ForegroundColor Yellow
  New-Item -Path "$env:TEMPRansomSim" -ItemType Directory -Force | Out-Null
  Start-Process "icacls.exe" -ArgumentList "$env:TEMPRansomSim /grant:r everyone:F" -Wait
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup script to remove artifacts created during simulation
  Write-Host "[+] Cleaning up simulation artifacts..." -ForegroundColor Cyan
  schtasks /Delete /TN UpdateSystem /F
  Remove-Item -Path "$env:TEMPRansomSim" -Recurse -Force
  Write-Host "[+] Cleanup Finished." -ForegroundColor Green