Skip to main content

Monadnock Cyber · Ransomware Group Profile The Gentlemen — Ransomware Group Profile

 

Monadnock Cyber · Ransomware Group Profile

The Gentlemen — Ransomware Group Profile

TLP:CLEAR | 2026-10-05 | Monadnock Cyber LLC

Executive summary

The Gentlemen is a ransomware-as-a-service operation that emerged in September 2025. It runs double extortion — it encrypts files and threatens to leak stolen data. It works across many sectors and countries, using compromised VPN credentials, kernel-level driver abuse, and common administrative tools to get in, move laterally, and encrypt. We hold high confidence in the methods below.

Targeting

  • Geography: United States (18 listed victims), Brazil (6), United Kingdom (4), India (4). Other listed victims include a Spanish hospital and a Korean safety-systems firm.
  • Sectors: manufacturing, construction, healthcare, insurance, engineering, and industrial.
  • Selection: broad targeting weighted toward internet-facing infrastructure and remote access, rather than sector-specific espionage. Leak-site listings are claims, not confirmed breaches.

Attacker methods

Initial access

  • Brute-forced VPN credentials (operators held 969 validated FortiGate VPN logins)
  • Exposed remote-access gateways
  • Targeted products: FortiGate, SonicWall VPN, Cisco ASA appliances, Oracle E-Business Suite

Reconnaissance

  • Advanced IP Scanner to map the network and find high-value systems

Defense evasion

  • Bring-Your-Own-Vulnerable-Driver: All.exe paired with the ThrottleBlood.sys driver to kill EDR/antivirus at the kernel
  • Disabling Windows Defender
  • Deleting Volume Shadow Copies

Lateral movement

  • PsExec over SMB admin shares, blended into normal administrative traffic

Exfiltration & persistence

  • WinSCP over encrypted channels for data theft
  • Persistence through AnyDesk and modified registry keys

Encryptor

  • Supports Windows, Linux, and ESXi
  • Windows variant written in Go; requires a password argument to run
  • Appends .7mtzhh; drops README-GENTLEMEN.txt

In plain terms — what the attacker is doing

  • Initial access: The attacker guesses or steals login codes for your public websites and email systems to get inside.
  • Reconnaissance: The attacker scans your entire office network to locate your most important data storage systems.
  • Defense evasion: The attacker turns off your protection programs and erases system recovery options so they cannot be stopped easily.
  • Lateral movement: The attacker moves silently through your connected devices to reach every part of your business network.
  • Exfiltration & persistence: The attacker copies your private files to external computers and installs hidden access tools for future entry.
  • Encryptor: The attacker locks all your business computers and leaves a demand for payment to unlock them.

How to protect

Control areaRecommendation
Perimeter & remote accessHarden and patch all internet-facing VPNs and gateways (FortiGate, SonicWall, Cisco ASA, Oracle E-Business Suite). Enforce phishing-resistant multi-factor authentication on every remote-access path.
Endpoint protectionBlock and monitor vulnerable-driver loading. Enforce tamper protection on EDR/antivirus to defeat the kernel-driver technique.
Network monitoringAlert on PsExec and SMB admin-share use outside known maintenance windows.
Remote tools & transferAlert on remote-access and file-transfer tools (AnyDesk, WinSCP) in environments that do not use them.
Backup & recoveryKeep offline or immutable backups; guard Volume Shadow Copies from deletion.

What this means for you

  • Perimeter & remote access: Update your login gateways regularly and require a second sign-in step for every remote connection.
  • Endpoint protection: Stop unauthorized software from installing on your computers and keep your security software switched on at all times.
  • Network monitoring: Watch for remote administration tools running on your network outside normal working hours.
  • Remote tools & transfer: Treat unexpected remote-control or file-sharing software as a warning sign and check it out.
  • Backup & recovery: Store copies of your data in a separate place that attackers cannot change, and test that you can restore them.

Confidence & gaps

We assess with high confidence that the methods above are accurate — they are corroborated across three primary-vendor reports and consistent with known ransomware-as-a-service patterns. Gaps: the full extent of targeting beyond listed victims, and the group's specific motivation, remain unconfirmed.

Sources

SourceReliabilityNote
Trend Micro — Unmasking The GentlemenVendor CTI, highMethod analysis
Huntress — defense-evasion analysisVendor CTI, highKernel-driver (BYOVD) detail
Group-IB — Hastalamuerte / GentlemenVendor CTI, highService-model methods
COBALT ransomware_victimsLeak-site listings, moderateVictimology (claims, not confirmed breaches)
MITRE ATT&CKA-2Technique attribution (capability, not victim proof)

Handling & method

Prepared from open-source and licensed collection only; no personally identifiable information retained. Collection and analysis run locally on Monadnock infrastructure. Graded to ICD-203 and cross-checked across local models before release.

Draft authored on qwen3.6 (structure) and verified/edited to the Monadnock standard; pending the three-model rigor panel.

Comments

Post a Comment

Popular posts from this blog

Am I a Target? Daily Cyber Brief MONADNOCK CYBER • Monday, September 21, 2026

Am I a Target ? Daily Cyber Brief MONADNOCK CYBER  •  Monday, September 21, 2026  •  At the intersection of AI and Security What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Confirmed facts and unverified claims are labeled throughout. ● Foreign desk · raw & unevaluated China Desk: what Beijing is saying about cyber today New this week: we’re pulling foreign-language coverage into collection. This is a first, unfiltered look — machine-translated, not yet source-graded, and it includes Chinese state media. Read it as raw signal, not a finished assessment. China is running its annual National Cyber Security Awareness Week (launched September 14, nationwide). This year’s theme centers on the “intelligent era” — AI security (“智能时代 网安护航”). Coverage across state and commercial outlets (China.com.cn [1] , Guangming, Baidu) carries these themes: AI at machine speed. A widely-run piece frames it as the “attack-and-defense battle” of ...
Post a Comment
Read more

Above the Fold What foreign press tells its own public · a Monadnock Cyber summary

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 26 September 2026 · ATF-2026-09-26 · TLP:CLEAR Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. Global Cyber Weather Report · 26 September 2026 OUTLOOK Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity. CONDITIONS NOW Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment ca...
Post a Comment
Read more

Above the Fold | What foreign press tells its own public | A Monadnock Cyber summary 24 September 2026 ·

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 24 September 2026 · ATF-2026-09-24 Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. In this issue 01   Iran   From data theft to sabotage: Iran's banks under service-disruption attacks 02   Russia   Under siege, wearing an AI mask: NightEagle and AI-crawler disguise 03   China   National Cyber Security Week: AI Safety Governance Framework 3.0 04   European Union   Cutting the cord: Europe moves to wean its governments off US clouds 05   Brazil   Braz...
Post a Comment
Read more