The Gentlemen

The malware uses WMI via wmic.exe to create remote processes.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

Before attempting to run the payload on a remote system, the malware executes the following PowerShell command on the remote target to weaken local defenses and make payload execution more reliable.

Le ransomware est distribué à l'échelle du domaine via les partages NETLOGON; Cloudflared est exécuté comme service Windows.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

The commands copy the malware executable into C:\Temp, creates a hidden Server Message Block (SMB) share named share$ pointing to that directory, and modifies registry settings to allow anonymous access.

The malware executes the following command sequence to create three Windows services on the target host.

The GupdateS value under HKEY_LOCAL_MACHINE (HKLM) provides device-wide persistence that allows the malware to run at startup for all users, while the GupdateU value under HKEY_CURRENT_USER (HKCU) provides user-scoped persistence within the current profile.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

Their research shows the ransomware follows a very deliberate sequence, starting with password validation and privilege escalation, then moving into defense evasion, encryption, and finally network-wide spreading.

[They deployed] The Gentlemen ransomware through a malicious Group Policy Object.

The malware executes the following command sequence to create three Windows services on the target host.

The GupdateS value under HKEY_LOCAL_MACHINE (HKLM) provides device-wide persistence that allows the malware to run at startup for all users, while the GupdateU value under HKEY_CURRENT_USER (HKCU) provides user-scoped persistence within the current profile.

When the -- system argument is provided... the malware creates a scheduled task to re-execute itself as SYSTEM.

To further impede recovery efforts, the malware deletes all Volume Shadow Copies using both vssadmin and wmic... It then clears the System, Application, and Security event logs using wevtutil to remove key audit trails.

Additionally, the malware manually deletes PowerShell command history across all user profiles... If the -- keep flag is not provided, the malware attempts to remove its executable from disk after completing encryption.

The commands copy the malware executable into C:\Temp, creates a hidden Server Message Block (SMB) share named share$ pointing to that directory, and modifies registry settings to allow anonymous access.

[They deployed] The Gentlemen ransomware through a malicious Group Policy Object.

Before starting file encryption, the malware executes a sequence of commands to disable defensive controls and remove potential forensic artifacts.

Before touching a single file, the ransomware works to disable Microsoft Defender, wipe forensic logs... It also clears command history

After dropping PsExec, the malware attempts to enumerate and discover remote systems on the network, including workstations, servers, and domain controllers.

the malware pulls in a legitimate system tool called PsExec... and starts scanning the network for reachable machines, including regular workstations, servers, and domain controllers.

The malware stops a list of running processes using the command: The table below summarizes the different categories and processes being targeted.

The -- spread argument accepts either explicit credentials in domain/user:password format for authenticated lateral movement, or an empty string to reuse the current session’s authentication token.

To enumerate all available volumes on the system, the malware executes the following PowerShell command sequence.

When the command-line argument -- shares is provided, the malware initiates network share discovery and enumeration. It begins by probing all drive letters A through Z to identify mapped network drives.

the custom ransomware locker, the RaaS panel and builder ... as well as the GPO-based spread mechanism and the locker’s 'spread' module.

Le ransomware peut cibler des chemins UNC, par exemple \\<IP>\c$\users, et Restic a accédé à \\10.0.0.221\D$.

Once activated, the infected machine turns itself into a distribution hub by copying its own binary into a folder and publishing it over a hidden network share configured for anonymous access.

The malware binary carries an embedded copy of PsExec and drops it to C:\Temp\psexec.exe on the infected device. If the embedded PsExec payload cannot be extracted successfully, the malware falls back to downloading PsExec directly from Microsoft’s Sysinternals Live service.

The operators behind the ransomware use double extortion tactics, encrypting data while also exfiltrating sensitive information to pressure victims through the threat of public release if the ransom is not paid.

Combined with double extortion tactics, where stolen data is used as leverage alongside encryption, the threat represents a serious risk for organizations of nearly any size or sector.

delete Volume Shadow Copies twice over using two separate commands for reliability. It also clears command history and deletes backup and recovery tools to make restoring systems without paying much harder.

The Gentlemen ransomware [was] deployed... DeadLock applies a similar mechanism to victim communications after encryption.

In addition to terminating processes, the malware disables and stops a list of Windows services.

sc config VeeamBackupSvc start= disabled; sc config SQLWriter start= disabled; sc config BackupExecAgent start= disabled.

If the -- wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine to eliminate recoverable artifacts from disk.

DeadLock's application... displays the operators' claims of stolen data... The attackers' use of Rclone to send files to Wasabi shows why transfers to cloud storage should be checked.