Gentlemen Ransomware

The affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

Initial access appears to come from exposed firewall management interfaces, unpatched devices, or stolen VPN credentials. A Fortinet SSL VPN account without multi-factor authentication gave the intruder a foothold.

It relies on diverse utilities including PsExec, WMIC, and remote PowerShell commands.

Upon execution, the payload aggressively executes PowerShell commands to disable Microsoft Defender real-time monitoring.

The affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

They increased their control by changing administrator passwords, adding accounts to privileged groups, and enabling remote desktop access.

Initial access appears to come from exposed firewall management interfaces, unpatched devices, or stolen VPN credentials. A Fortinet SSL VPN account without multi-factor authentication gave the intruder a foothold.

The affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

They increased their control by changing administrator passwords, adding accounts to privileged groups, and enabling remote desktop access.

The attackers staged the ransomware from an internal server and leveraged built-in propagation and Group Policy (GPO) to trigger near-simultaneous execution of the encryptor across domain-joined systems.

In one intrusion, they also cleared Application, System, and Security event logs, obscuring the evidence responders need to trace the breach.

For example, it forcibly deletes Volume Shadow Copies via administrative command utilities.

The affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

The attackers staged the ransomware from an internal server and leveraged built-in propagation and Group Policy (GPO) to trigger near-simultaneous execution of the encryptor across domain-joined systems.

They placed their toolkit in a trusted Windows location that is often overlooked, then mapped systems, data stores, and backup infrastructure before the visible stage of the attack began.

The worm systematically attempts 21 distinct remote execution operations against each discovered network host.

The malware immediately prepares the infected machine to function as a primary distribution hub. Then, it copies itself into a temporary folder and establishes a hidden network share.

The worm systematically attempts 21 distinct remote execution operations against each discovered network host. It relies on diverse utilities including PsExec, WMIC, and remote PowerShell commands.

The affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol... they created firewall rules to allow outside RDP connections.

The locker was deployed locally, through network shares, or across the domain using centralized logon shares and remote execution.

Before locking systems, the group copied selected files with legitimate transfer tools... Researchers saw them switch among transfer utilities and object-storage methods as conditions changed.

The locker was deployed locally, through network shares, or across the domain using centralized logon shares and remote execution. It encrypted files, assigned a six-character extension, and left a ransom note in affected directories.

Next, the payload terminates an extensive directory of active corporate services and applications. The targeted processes encompass enterprise databases, virtualization modules, and email management software.

Backup services were then disabled, often immediately before encryption. They targeted recovery and backup-agent services, making it harder for teams to restore systems.

For instance, it generates a temporary file named wipefile.tmp to fill all remaining disk space with random data. This process completely overwrites unallocated sectors to obstruct digital forensic tools.

Concurrently, the application exfiltrates confidential corporate files to cloud storage repositories. The attackers then threaten to release this data publicly if the corporate victim refuses payment.

Attackers used custom and publicly available utilities, including vulnerable drivers, to terminate antivirus and endpoint detection and response processes. They also weakened Windows Defender by adding broad scan exclusions or changing policy settings.

In several cases, they created firewall rules to allow outside RDP connections, providing a fallback route if the originally compromised VPN session was lost.