A key characteristic of "The Gentlemen" ransomware is its self-propagation capability, allowing it to spread across compromised networks through various lateral movement techniques. Developed in the Go programming language, the ransomware leverages Garble for code obfuscation, making reverse engineering, static analysis, and detection more challenging.

It targets multiple platforms including Windows, Linux, BSD, NAS devices, and VMware ESXi environments. The group has been associated with attacks targeting organizations across critical sectors including healthcare, construction, finance, and manufacturing.

Infection Mechanism

Threat actors exploit vulnerabilities in internet-facing edge devices and remote access solutions, including RDP, cPanel, and VPNs or abuse compromised credentials to gain initial access to victim environments. Following initial access, they conduct extensive system, network and Active Directory reconnaissance using tools such as Advanced IP Scanner and Nmap. The attackers further exploit legitimate administrative utilities, compromised credentials, scheduled tasks and automated propagation mechanisms to facilitate lateral movement across the victim's network. Additionally, they abuse Group Policy Objects (GPOs) to distribute malicious configurations across domain systems and establish persistence through Windows Registry modifications, unauthorized deployment of remote access software, and alterations to authentication mechanisms and Remote Desktop Protocol (RDP) configurations.

Attack Techniques of The Gentlemen Ransomware

Indicators of Compromise (IoCs)

HASHES:

NETWORK INDICATORS:

IP Addresses:

45.227.254[.]43
45.227.254[.]45
45.227.254[.]84
179.60.149[.]68
89.185.83[.]8
138.124.113[.]210
77.110.109[.] 248

Domains:

system-strategy[.]org
iquickline[.]com
mcgrawney[.]com
cloud-update[.]live
bossprotect[.]com

• Review all public IP addresses associated with the organisation and identify internet-facing services, open ports and applications accessible through them that may introduce unnecessary exposure, misconfigurations or security weaknesses. Disable or decommission services that are not required for business operations, restrict access to essential services to authorised sources wherever feasible, and ensure that externally accessible services are appropriately hardened, patched and monitored for suspicious activity.
  
  
• Ensure that internet-facing firewalls, VPN appliances and other network security devices are running the latest security patches and firmware updates. Enforce Multi-Factor Authentication (MFA) for all remote access, including VPN connections.
  
  
• Ensure that administrative interfaces, management consoles and control panels of servers, network devices, security appliances and applications are not directly accessible from the public internet. Restrict management access to dedicated management networks or trusted IP addresses, with appropriate authentication and access controls.
  
  
• Conduct regular Vulnerability Assessment and Penetration Testing (VAPT) to identify exposed services, misconfigurations and weaknesses in the organization's security infrastructure.
  
  
• Enable appropriate security logging and continuous monitoring particularly for all internet-facing assets, including web servers, firewalls and VPN appliances. Review logs and security alerts to identify unauthorised access attempts, suspicious activities and potential exploitation.
  
  
• Maintain regular offline backups of critical business data and ensure that backup restoration procedures are tested periodically.
  
  
• Ensure backup repositories are encrypted, immutable and isolated from production environments to prevent unauthorized modification or deletion.
  
  
• Implement strong, unique passwords for all user, administrator, service and domain administrator accounts.
  
  
• Restrict privileged account usage and apply the principle of least privilege across the enterprise environment.
  
  
• Disable unnecessary RDP access and restrict remote connections to authorized administrative systems. Implement Network Level Authentication (NLA), account lockout policies and appropriate RDP logging.
  
  
• Restrict SMB administrative shares and allow access only from authorized administrative workstations and servers.
  
  
• Implement network segmentation to isolate domain controllers, backup infrastructure, critical databases and production environments.
  
  
• Deploy web servers in a dedicated and segregated network zone (DMZ), isolated from internal networks and critical infrastructure, and enforce restrictive firewall rules to control and monitor traffic between the DMZ and internal networks.
  
  
• Ensure that web servers and hosted applications undergo security audits, are protected against malware infections, and are secured using a Web Application Firewall (WAF) to mitigate malicious traffic.
  
  
• Regularly review Group Policy Objects (GPOs), domain administrator memberships and modifications to the NETLOGON and SYSVOL shares.
  
  
• Deploy Endpoint Detection and Response (EDR) / Anti-Virus (AV) solutions with tamper protection enabled to prevent unauthorised disabling, modification or termination of security agents by users or processes. Ensure that real-time protection is enabled and periodic malware scans are conducted across all endpoints in the network.
  
  
• Monitor attempts to load vulnerable or unauthorized drivers and enforce Windows driver signature verification.
  
  
• Monitor the execution of suspicious utilities, including AnyDesk, PsExec, PowerRun, Advanced IP Scanner and Nmap, particularly when used by unauthorized accounts or from unusual locations.
  
  
• Implement application control and software restriction policies to prevent unauthorized binaries from executing from temporary directories, user download folders and other commonly abused locations.
  
  
• Monitor unusual PowerShell activity, encoded commands, mass Active Directory enumeration and unexpected scheduled task or Windows service creation.
  
  
• Enable centralized logging and forward Windows Security, System, PowerShell and endpoint security logs to a protected SIEM platform.
  
  
• Monitor suspicious attempts to disable Microsoft Defender, modify security exclusions, terminate endpoint protection processes or clear Windows event logs.
  
  
• Monitor unusual data staging and outbound transfers involving WinSCP, WebDAV and other file-transfer utilities.
  
  
• Keep operating systems, VPN appliances, firewalls, endpoint security products and third-party applications updated with the latest security patches.
  
  
• Implement email security controls, including SPF, DKIM and DMARC, to reduce phishing and email spoofing risks.
  
  
• Conduct regular cybersecurity awareness training to help employees identify suspicious emails, malicious attachments and social engineering attempts.
  
  
• Develop and periodically test an incident response plan covering ransomware containment, forensic investigation, data recovery and business continuity.
  
  
• In case of suspected compromise, isolate affected systems from the network, preserve relevant forensic evidence and initiate incident response procedures.
  
  
• Organizations are strongly discouraged from paying ransom demands, as payment does not guarantee data recovery or prevent the disclosure of stolen information. Report ransomware incidents to CERT-In and relevant law enforcement agencies in accordance with applicable requirements.