The Gentlemen is one of the most rapidly escalating ransomware threats observed in 2026. Emerging in mid-2025 from a payment dispute within the Qilin RaaS program, the group has evolved into a full-spectrum, human-operated Ransomware-as-a-Service (RaaS) operation that Microsoft tracks as Storm-2697.
Within its first year of independent operation, The Gentlemen has claimed over 500 victims across 70+ countries, accounting for approximately 10% of all global ransomware activity in April 2026.
What sets this group apart is not scale alone it is their operator-maintained EDR/AV killer infrastructure, marketed directly to affiliates under the in-house framework named GentleKiller, comprising at least eight distinct BYOVD (Bring Your Own Vulnerable Driver) variants capable of terminating over 400 security processes across 48 vendors.
The gang also integrates third-party EDR killers HexKiller, ThrottleBlood, and HavocKiller into a standardized, modular evasion suite. Coupled with a Go-based, self-propagating worm encryptor using hybrid Curve25519/XChaCha20 cryptography, The Gentlemen represents a Tier-1 threat to manufacturing, healthcare, financial services, and critical operational technology environments worldwide.
A significant intelligence windfall arrived in May 2026, when an internal backend database (“Rocket”) used by the group was leaked, exposing 3,366 internal chat messages, operator identities, victim lists (1,570+ confirmed), ransom negotiation transcripts, and the full toolchain.
At Cybersecuritynews, we synthesize published intelligence from the leak, ESET Research, Microsoft Threat Intelligence, Check Point Research, Trend Micro, and Huntress to deliver a comprehensive, defender-grade briefing.
Threat Actor Profile
Identity and Origin
The Gentlemen was founded by an operator using the alias hastalamuerte (also known as zeta88 and tracked by PRODAFT as LARVA-368). This individual was previously an affiliate crew leader within the Qilin RaaS program before launching The Gentlemen as an independent operation following a payment dispute in July 2025. The operator is described as Russian-speaking and maintains hands-on involvement in attacks in addition to managing the RaaS platform.
The group operates under a strict CIS exclusion policy targeting organizations globally but programmatically excluding victims in CIS (Commonwealth of Independent States) countries, consistent with Russian-nexus threat actor norms.
Organizational Structure
Analysis of the leaked Rocket.Chat database reveals a tightly organized core of approximately 9 named operators and at least 8 distinct affiliate TOX IDs. The organizational structure is as follows:
| Alias | Role |
|---|---|
zeta88 / hastalamuerte | Administrator builds locker, runs RaaS panel, distributes targets, manages payouts |
qbit | Hands-on operator Fortinet scanning, NTLM relay, AD recon, EDR killer deployment |
quant | Log-based access, credential harvesting, OxideHarvest/buildx641 tool maintainer |
Wick, mAst3r, Protagor | Red-teamers, advertising partners, case-specific collaborators |
Bl0ck, JeLLy, Kunder, Mamba | Access brokers, support roles |
The administrator actively uses AI-assisted development, referencing DeepSeek, Qwen, and Kimi for coding assistance and panel development. The Gentlemen GLOCKER admin panel was reportedly built in three days using AI-assisted coding.
- Affiliate revenue split: 90% to affiliates, 10% to operators among the most generous in the ransomware ecosystem
- Affiliate recruitment: Active on RAMP and BreachForums underground forums; invites penetration testers and initial access brokers
- Partnership: Established an official BreachForums partnership in 2025 to expand the affiliate pool
- Extortion model: Double extortion encryption plus data exfiltration
- Ransom range: ~$250,000 initial demands; $190,000 settlements observed in leaked transcripts
- Leak site: Tor-based dedicated leak site (DLS) with branded X/Twitter account for additional public pressure
Attack Chain: Step-by-Step Lifecycle
Phase 1: Initial Access
The Gentlemen does not rely on phishing for initial access. Instead, affiliates systematically target internet-facing edge infrastructure, primarily FortiGate VPN appliances, Cisco ASA devices, and SonicWall appliances. The group maintained an active inventory of approximately 14,700 compromised FortiGate devices and 900+ validated brute-forced FortiGate VPN credentials ready for affiliate use.
Branding credentials observed in leaked data include: gentlemen25, Gentlemen25, gentle26.
Secondary access vectors include:
- Infostealer-sourced credentials from underground marketplaces
- Exploitation of exposed OWA/O365 portals using log-based credential tools (
quant‘s log parser) - Access brokers supplying pre-compromised enterprise footholds (“поставщик ботов”)
Phase 2: Reconnaissance and Privilege Escalation
After achieving initial foothold, operators perform extensive internal reconnaissance using a custom offensive toolkit:
- NetExec (NXC): Multi-purpose AD, SMB, WinRM offensive framework
- RelayKing-Depth: NTLM relay scanning and exploitation
- TaskHound: Task and privilege abuse
- PrivHound: Local privilege escalation path discovery
- CertiHound: Active Directory Certificate Services (ADCS) misconfiguration enumeration (ESC1–ESC17)
- gogo.exe: Port scanner for exposed services
- Advanced IP Scanner / Nmap: Network mapping (observed in Mackay Sugar incident)
- KslDump / KslKatz: Kerberos/LSASS credential dumping
The group specifically targets domain administrator credentials and abuses Group Policy Objects (GPOs) for domain-wide compromise.
Phase 3: Defense Evasion (EDR/AV Killing)
This is the defining characteristic of The Gentlemen. Operators deploy their centralized GentleKiller suite before encryption begins. Tools are staged in a directory named GentlemenCollection on the target system.
The BYOVD technique works as follows:
- Drop a signed-but-vulnerable kernel driver to disk
- Load the driver as a Windows service via
sc create/sc start - Send IOCTLs to the driver from user space, reaching Ring-0 (kernel) privilege
- Enumerate and kill all target security processes overcoming user-mode tamper protection
GentleKiller variants (8 known, each impersonating a different product):
| Variant Name | Fake Filename | Abused Driver | ESET Detection |
|---|---|---|---|
| Kaspersky | Kasp<suffix>.exe | eb.sys (custom rootkit PoC) | Win64/KillAV.EA |
| FACEIT Anti-Cheat | FaceIT<suffix>.exe | nseckrnl.sys (NSecsoft NSecKrnl) | Win64/KillAV.EA |
| Valorant | Valorant<suffix>.exe | GameDriverX64.sys / vgk.sys (Tower of Fantasy anti-cheat) | Win64/KillAV.EA |
| Javelin | EAAntiCheat<suffix>.exe, EASolo<suffix>.exe | stpm_old.sys, stpm_new.sys (Safetica Process Monitor) | Win64/KillAV.EA |
| WatchDog | BitD<suffix>.exe | dmx.sys (Zemana WatchDog Antimalware) | Win64/KillAV.EA |
| Network Blocker | MB<suffix>.exe | 360netmon_wfp.sys (Qihoo 360) | Win64/KillAV.EA |
| Cleaner | Deletor.exe | IMFForceDelete (IObit IMF ForceDelete) | Win64/KillAV.EA |
| G11 | G11<suffix>.exe, Symantec<suffix>.exe | G11.sys / PoisonX (rootkit PoC) | Win64/KillAV.EA |
Third-party EDR killers integrated into the suite:
| ESET Name | Fake Filename | Abused Driver | Notes |
|---|---|---|---|
| HexKiller | Avast<suffix>.exe | googleApiUtil64.sys (Baidu Antivirus BdApi) | Previously attributed to Warlock gang |
| ThrottleBlood | Sent<suffix>.exe | ThrottleBlood.sys (TechPowerUp LLC ThrottleStop) | Also seen in MedusaLocker, DragonForce |
| HavocKiller | HwAudKiller.exe, Sophos<suffix>.exe | havoc.sys (Huawei Audio Driver) | Active since Jan 2026, disclosed by Huntress Mar 2026 |
Additional evasion tools from leaked toolchain:
EDRStartupHinderblocks/delays EDR processes at startupgfreezeEDR process freezingglinkerEDR evasion companion to gfreezeDumpBrowserSecretsbrowser cookie/session harvesting- ETW (Event Tracing for Windows) patching and
zerosalariumtechniques TitanisWindows ETW/logging manipulation framework
Binary protection and impersonation strategy applied uniformly to all EDR killers:
| Filename Suffix | Protection | Fake Signature | Fake Version Info |
|---|---|---|---|
1 | Enigma | Yes | Yes |
2 | Themida | Yes | Yes |
Light | None | Yes | Yes |
Clear | None | No | No |
Phase 4: Lateral Movement and Persistence
The Gentlemen ransomware’s self-propagation (--spread) module attempts 21 independent remote execution techniques per target host, making it worm-like in behavior:
- 5.1 Remote file copy over
C$administrative share - 5.2 PsExec-based remote execution (embedded PsExec binary or downloaded from Sysinternals Live)
- 5.3 WMIC process creation (
wmic /node:<target> process call create) - 5.4 Scheduled tasks (user context)
DefU,UpdateGU,UpdateGU2 - 5.5 Scheduled tasks (SYSTEM context) same tasks elevated
- 5.6 Windows Services
DefSvc,UpdateSvc,UpdateSvc2 - 5.7 PowerShell Remoting via
Invoke-Command(WinRM) - 5.8 PowerShell WMI (
Invoke-WmiMethod) as alternative to wmic.exe
For persistence, the encryptor establishes two layers:
- Scheduled tasks:
UpdateSystem(SYSTEM context) andUpdateUser(current user context) - Registry Run keys:
GupdateSunderHKLM\...\RunandGupdateUunderHKCU\...\Run
Additional persistence observed: AnyDesk remote access software, Cloudflare Zero Trust tunnels, SystemBC SOCKS5 proxy.
C2 Framework: Velociraptor (used as covert C2), ZeroPulse, Cloudflare tunnels
Lateral movement tools: PsExec, PuTTY (observed in Mackay Sugar incident), WinSCP (for data exfiltration via encrypted channels)
Phase 5: Data Exfiltration (Pre-Encryption)
Exfiltration volumes of hundreds of gigabytes to multiple terabytes per victim are typical. The group uses WinSCP for encrypted file transfer and quant‘s custom credential/data collector (buildx641/OxideHarvest) which leverages:
vssadminshadow copiesntds.ditextractionSYSTEMhive copiesMANSPIDERfor sensitive file share hunting
Data from prior compromises is actively reused to facilitate new attacks a UK consultancy breach was leveraged to gain access to a Turkish company, with stolen internal documents used for cross-target enrichment.
Phase 6: Encryption and Impact
Encryption Technology
The encryptor is written in Go and obfuscated with Garble, targeting Windows, Linux, NAS, BSD, and ESXi platforms:
- Cryptographic scheme: Hybrid Curve25519 + XChaCha20
- Key design: Per-file ephemeral Curve25519 key pair; ECDH shared secret used as XChaCha20 key
- Nonce: First 24 bytes of the ephemeral public key; XOR-mutated per chunk for large files
- Encrypted file extension:
.umc16h(also.7mtzhhobserved in some samples) - Execution requires a build-specific
--passwordargument as an anti-analysis measure
Encryption Speed Modes
| CLI Argument | Per-Chunk % | Total Encrypted (Large Files) |
|---|---|---|
(default) | 9% | ~27% |
--fast | 3% | ~9% |
--superfast | 1% | ~3% |
--ultrafast | 0.3% | ~0.9% |
Small files (≤1 MB) are fully encrypted regardless of speed mode.
Post-Encryption Actions
The malware creates a scheduled task (gentlemen_system) to relaunch itself as SYSTEM for encrypting local drives.
- Ransom note:
README-GENTLEMEN.txtdropped in every traversed directory - Desktop wallpaper:
%TEMP%\gentlemen.bmpset as wallpaper - Shadow copy deletion:
vssadmin delete shadows /all /quietandwmic shadowcopy delete - Event log clearing:
wevtutil cl System,wevtutil cl Application,wevtutil cl Security - Prefetch deletion, Defender log wipe, RDP log wipe, PowerShell history removal
- Free space wiping (
--wipe): Overwrites all unallocated disk space with random data - Self-delete (unless
--keepflag): Removes encryptor binary post-execution
Network Share Discovery
When run with --shares, the encryptor enables Windows network discovery services (fdrespub, fdPHost, SSDPSRV, upnphost) and removes firewall restrictions to maximize reachable encryption targets.
Known Infection Vectors
| Vector | Mechanism | CVE/Tool | Confidence |
|---|---|---|---|
| FortiGate VPN exploitation | Authentication bypass in FortiOS/FortiProxy management interface | CVE-2024-55591 | High 81 mentions in leaked chat logs; 14,700+ compromised devices tracked |
| Erlang SSH / Cisco RCE | Remote code execution on Cisco and Erlang-based SSH services | CVE-2025-32433 | High PoC shared and evaluated in internal Rocket.Chat logs |
| NTLM Relay | Internal credential relay for privilege escalation post-initial access | CVE-2025-33073 | High RelayKing integrated into standard recon workflow |
| FortiGate VPN brute-force | Credential stuffing/brute-force of VPN web panels | ~900+ validated credentials in active use | High |
| Infostealer credentials | Purchased from underground markets; OWA/O365 portal abuse | N/A | High |
| Access brokers | Pre-compromised Fortinet VPN access purchased from “Mamba” and other brokers | N/A | High |
| SonicWall VPN, Cisco ASA, Oracle EBS | Active reconnaissance and exploit development noted | Under research by group | Medium |
| BYOVD kernel driver exploit | CVE-2025-7771 ThrottleStop.sys driver for kernel code execution | CVE-2025-7771 | Medium |
Common Vulnerabilities Exploited
| CVE | Product | Vulnerability Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2024-55591 | Fortinet FortiOS / FortiProxy | Authentication bypass in management interface enables unauthenticated super-admin access | Critical | Patch available widely unpatched |
| CVE-2025-32433 | Erlang/OTP SSH (Cisco context) | Pre-authentication remote code execution | Critical | PoC actively evaluated by operators |
| CVE-2025-33073 | Windows NTLM | NTLM reflection/relay privilege escalation | High | Actively scanned using RelayKing |
| CVE-2025-7771 | TechPowerUp ThrottleStop.sys | Kernel code execution via vulnerable driver (BYOVD) | High | Integrated as ThrottleBlood.sys |
| CVE-2023-27532 | Veeam Backup & Replication | Missing authentication targeted for backup destruction | Critical | Patching recommended |
| CVE-2024-37085 | VMware ESXi | Authentication bypass ESXi locker deployment vector | High | Patching recommended |
| Multiple ADCS flaws | Microsoft Active Directory Certificate Services | ESC1–ESC17 misconfigurations (CertiHound) | Variable | Enumerated post-compromise |
Known Tools Used
Full Toolchain Reference
| Category | Tool | Purpose |
|---|---|---|
| EDR Killing (In-House) | GentleKiller (8 variants) | BYOVD kernel-level security process termination (400+ processes, 48 vendors) |
| EDR Killing (Third-Party) | HexKiller | BYOVD EDR killer (Baidu BdApi driver) |
| EDR Killing (Third-Party) | ThrottleBlood | BYOVD EDR killer (ThrottleStop.sys driver) |
| EDR Killing (Third-Party) | HavocKiller | BYOVD EDR killer (Huawei Audio driver) |
| EDR Evasion | EDRStartupHinder | Blocks/delays EDR processes at startup |
| EDR Evasion | gfreeze | EDR process freezing utility |
| EDR Evasion | glinker | EDR evasion companion tool |
| Credential Theft | OxideHarvest (buildx641.exe) | Rust-based credential stealer; harvests browsers, LSASS, NTDS |
| Credential Theft | DumpBrowserSecrets | Browser cookie and session token harvester |
| Credential Theft | KslDump / KslKatz | Kerberos / LSASS credential dumping |
| Credential Theft | Mimikatz | Credential extraction (operator referenced in multiple incidents) |
| AD Recon | NetExec (NXC) | SMB, AD, WinRM, LDAP offensive framework |
| AD Recon | RelayKing-Depth | NTLM relay path discovery and exploitation |
| AD Recon | CertiHound | ADCS misconfiguration enumeration (ESC1–ESC17) |
| Privilege Escalation | PrivHound | Local privilege escalation path finder |
| Privilege Escalation | TaskHound | Task and privilege abuse |
| Privilege Escalation | RegPwn | Registry-based service privilege escalation |
| Lateral Movement | PsExec | Remote execution; embedded in ransomware binary |
| Lateral Movement | WinSCP | Encrypted data exfiltration |
| Lateral Movement | MANSPIDER | Sensitive file share hunting |
| C2 / Remote Access | Velociraptor | Covert C2 with LSASS/memory collection |
| C2 / Remote Access | ZeroPulse | Remote access framework |
| C2 / Remote Access | AnyDesk | Persistent remote access |
| C2 / Remote Access | SystemBC | SOCKS5 proxy for covert C2 tunneling |
| C2 / Remote Access | Cloudflare Zero Trust / Tunnels | Covert HTTPS tunneling into victim networks |
| C2 / Remote Access | Cobalt Strike | Beacon-based C2 framework |
| Infrastructure | gogo.exe | Port scanner for initial surface discovery |
| ETW Evasion | Titanis | Windows ETW/logging manipulation |
| ETW Evasion | zerosalarium | ETW and log-based EDR kill research/techniques |
| OSINT | Sputnik (browser extension) | OSINT aggregation for target enrichment |
| Password Cracking | chamd5.org / hashcracking_bot | Online hash cracking services |
| VPN Infrastructure | WireGuard, OpenVPN, Double-VPN | Operator-side VPN for operational security |
| GPO Deployment | Group Policy Management / Editor | Domain-wide ransomware deployment via NETLOGON |
Targeted Industries and Victimology
Industries by Victim Count (Top 5)
| Rank | Industry | Victim Count |
|---|---|---|
| 1 | Manufacturing | 101 |
| 2 | Business Services | 66 |
| 3 | Technology | 65 |
| 4 | Healthcare | 50 |
| 5 | Consumer Services | 44 |
Additional targeted sectors include: Construction, Education, Transportation, Financial Services, Insurance, Agri-Industrial (food production/sugar processing), Pharmaceuticals, and Critical Infrastructure (OT/ICS environments).
Geographic Focus (Top 5 Countries)
| Rank | Country | Victim Count |
|---|---|---|
| 1 | United States | 87 |
| 2 | Thailand | 37 |
| 3 | France | 28 |
| 4 | Germany | 24 |
| 5 | Australia | ~20 (estimated 4th most targeted per CheckPoint) |
The Gentlemen is notable for its non-US-centric victimology; unlike most top-tier ransomware gangs, it maintains heavy focus on Southeast Asia, South America, and Western Europe. Targeting decisions are made primarily based on FortiGate device misconfiguration rather than geographic location.
Notable Attack: Mackay Sugar (June 2026)
In June 2026, The Gentlemen claimed responsibility for a ransomware attack on Mackay Sugar, Australia’s second-largest raw sugar producer. The attack shut down operations at the Farleigh and Racecourse mills for over a week, disrupting cane haulage and affecting 1,300+ family-owned farms.
The attack was executed via the NETLOGON share for payload deployment, with double-extortion threatening to release stolen data within 10 days.
Indicators of Compromise (IoCs)
File Hashes
Ransomware Encryptors
| SHA-256 / SHA-1 Hash | Filename | Platform | Description | Source |
|---|---|---|---|---|
22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67 | ransomware binary | Windows | Windows encryptor (primary analyzed sample) | Microsoft |
078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b | psexec.exe | Windows | PsExec binary embedded in encryptor | Microsoft |
fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68 | gentlemen.bmp | Windows | Post-encryption desktop wallpaper bitmap | Microsoft |
f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8 | G_hlm7jj_windows_amd64.exe | Windows | Encryptor (second Huntress-observed incident) | Huntress |
1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c | Linux locker | Linux | Linux/NAS encryptor variant | Decryption Digest |
c12c4d58541cc4f75ae19b65295a52c559570054 | Ransom.Win64.GENTLEMAN | Windows | Trend Micro signature Mackay Sugar incident | Rescana/Trend |
GentleKiller EDR Killer Suite (SHA-1 Hashes)
| SHA-1 | Filename | ESET Detection | Description |
|---|---|---|---|
8AE6BD18B129061F63642531F1B684CF0383C75D | Kasps.exe | Win64/KillAV.EA | GentleKiller Kaspersky variant |
BA914FE77B177B45799403B16DD14765C510A074 | eb.sys | Win64/Agent.ITG | Custom rootkit Kaspersky variant driver |
D605994FC72A2BB59B5CFB1624A1B9170ECA73A2 | FaceIT1.exe | Win64/KillAV.EA | GentleKiller FACEIT variant (Enigma-protected) |
B0B912A3FD1C05D72080848EC4C92880004021A1 | nseckrnl.sys | Win64/VulnDriver.NSecsoft.A | NSecKrnl driver FACEIT variant |
5AA3124E5C4921E5EDFC60133B5D71DA21B07DA3 | Valorant2.exe | Win64/KillAV.EA | GentleKiller Valorant variant (Themida-protected) |
7556AE58C215B8245A43F764F0676C7A8F0FDD1A | vgk.sys | Win64/VulnDriver.PerfectWorld.A | Anti-cheat driver Valorant variant |
331879F5EEC8892BBD896F90BDBB1BAD0BF63BD6 | EASolo2Light.exe | Win64/KillAV.EA | GentleKiller Javelin variant (newer Safetica driver) |
F11AEBCCB9A86A7E2E653F90BAEC697F233C255F | EASOLO1clear.exe | Win64/KillAV.EA | GentleKiller Javelin variant (older Safetica driver) |
EF9CD06683159397F099CAA244E94E6EAAD96EBA | EAAntiCheatLight.exe | Win64/KillAV.EA | GentleKiller Javelin variant (both Safetica drivers) |
711EF221526997039E804A18DB9647C91680BBE2 | stpm_old.sys | Win64/VulnDriver.Safetica.A | Safetica Process Monitor Driver (older) |
68FEC379F2AE76C3D2CE913F7BE650CEA1D06990 | stpm_new.sys | Win64/VulnDriver.Safetica.H | Safetica Process Monitor Driver (newer) |
A11EE9CDC59E5CAA59AEFD27B30D104F3AD68E62 | BitD1.exe | Win64/KillAV.EA | GentleKiller WatchDog variant (Themida-protected) |
96F0DBF52AED0AFD43E44500116B04B674F7358E | dmx.sys | Win64/VulnDriver.WatchDogDev.C | Zemana WatchDog Antimalware Driver |
2F86898528C6CAB3540C486A9BFAA0C029B73950 | MB2.exe | Win64/KillAV.EA | GentleKiller Network Blocker variant (Themida-protected) |
9AD51AD97C01E97AB59214116740785E0F6320A8 | 360netmon_wfp.sys | Win64/VulnDriver.Qihoo360.A | Qihoo 360 driver Network Blocker variant |
A19117175DBC9BA4D23B5DCE8415E299A2E32192 | Deletor.exe | Win64/KillAV.EA | GentleKiller Cleaner variant |
12500F6C87CE62712A0ED6652C57468D15C14223 | IMFForceDelete | Win64/VulnDriver.IObit.D.gen | IObit IMF ForceDelete driver Cleaner variant |
D29670E684E40DDC89B47010C37CBC96737035B6 | Symantec.exe | Win64/KillAV.EA | GentleKiller G11 variant |
56BEE9DF5833A637F5C54D5911DF98B0812FE643 | G11.sys | Win64/Agent.IYQ | PoisonX rootkit G11 variant |
Third-Party EDR Killers (SHA-1 Hashes)
| SHA-1 | Filename | ESET Detection | Description |
|---|---|---|---|
CF4D74DF17A91B4A36A2911B22AFEC5D8FA93A01 | Avast.exe | Win32/KillAV.NVL | HexKiller (Gentlemen evasion layer applied) |
EC296F9501AD71E430810CB5CDC38D954D4BA536 | googleApiUtil64.sys | Win64/VulnDriver.Baidu.B | Baidu Antivirus BdApi driver HexKiller |
7131B377E96016DC1911020C9F95B1B4D042D7B4 | Sent.exe | Win64/KillAV.AT | ThrottleBlood (Gentlemen evasion layer applied) |
82ED942A52CDCF120A8919730E00BA37619661A3 | ThrottleBlood.sys | Win64/VulnDriver.GPUZ.B | ThrottleStop.sys vulnerable driver ThrottleBlood |
F0537CBB773AE12100B36731E7C39F5A9D852B14 | Sophos.exe | Win64/KillAV.DE | HavocKiller (Gentlemen evasion layer applied) |
1FA071303FB846308571E64727501FB98B1C2BE6 | havoc.sys | Win64/VulnDriver.Huawei.D | Huawei Audio vulnerable driver HavocKiller |
Credential Stealer (OxideHarvest)
| SHA-1 | Filename | ESET Detection | Description |
|---|---|---|---|
A5CF917EC4A7DFBDFA43621398604805D860C718 | buildx641.exe | Win64/Spy.Agent.AGC | OxideHarvest credential stealer (quant’s tool) |
D4B19141102015D436321E6F26976E98183CFD27 | buildx64.exe | Win64/Spy.Agent.AGC | OxideHarvest credential stealer (alternate build) |
Additional Hashes (Trend Micro / Mackay Sugar Incident)
| SHA-1 | Detection Name | Description |
|---|---|---|
c12c4d58541cc4f75ae19b65295a52c559570054 | Ransom.Win64.GENTLEMAN.THHAIBE | Gentlemen Windows encryptor |
c0979ec20b87084317d1bfa50405f7149c3b5c5f | Trojan.Win64.KILLAV.THHBHBE | EDR killer tool |
df249727c12741ca176d5f1ccba3ce188a546d28 | Trojan.Win64.KILLAV.THHBHBE | EDR killer tool |
e00293ce0eb534874efd615ae590cf6aa3858ba4 | HackTool.Win32.PowerRun.THHBHBE | Privilege escalation tool (PowerRun.exe) |
Network Indicators
| Indicator | Type | Description | Source |
|---|---|---|---|
193.233.202[.]17 | C2 IP | SOCKS proxy C2 svchost32.exe beacon on port 44729 | Huntress |
77.110.122[.]137 | C2 IP | Alternative SOCKS proxy C2 port 37182 | Huntress |
45[.]86[.]230[.]112 | C2 IP | Pre-ransomware staging host Gentlemen affiliate infrastructure | HivePro |
| Cloudflare WARP tunnels | Tunnel indicator | Outbound Cloudflare WARP tunnel from non-IT endpoints (pre-encryption staging) | Decryption Digest |
File System and Host-Based Indicators
| Indicator | Type | Description |
|---|---|---|
.umc16h | File extension | Primary encrypted file extension |
.7mtzhh | File extension | Alternate encrypted file extension observed in some campaigns |
.fjn1jw | File extension | Alternate extension (observed in Huntress shipping/transport incident) |
README-GENTLEMEN.txt | Ransom note filename | Dropped in every traversed directory |
gentlemen.bmp | Wallpaper artifact | Desktop wallpaper deployed post-encryption (%TEMP%\gentlemen.bmp) |
gentlemen_system | Scheduled task name | SYSTEM-privilege scheduled task for local encryption |
UpdateSystem | Scheduled task name | Persistence scheduled task (SYSTEM context) |
UpdateUser | Scheduled task name | Persistence scheduled task (user context) |
WindowsConnSvc | Scheduled task name | SOCKS proxy persistence task (svchost32.exe C2 beacon) |
GupdateS | Registry Run key value | HKLM\...\Run\GupdateS system-wide persistence |
GupdateU | Registry Run key value | HKCU\...\Run\GupdateU user-scope persistence |
LOCKER_BACKGROUND=1 | Environment variable | Set when ransomware runs as background encryption worker |
C:\Temp\psexec.exe | Drop path | PsExec dropped for lateral movement |
C:\Temp\share$ | Hidden SMB share | Created for remote payload distribution |
C:\Temp\wipefile.tmp | Wipe artifact | Temporary file used for free-space wiping |
<malware_path>.bat | Self-delete script | Batch script for post-encryption self-deletion |
GentlemenCollection\ | Staging directory | Directory where EDR killer suite is staged |
svchost32.exe | Malicious process | SOCKS proxy beacon disguised as Windows system process |
WIN-8OA3CCQAE4D | Workstation name | Observed malicious workstation (Huntress May 2026 incident) |
YARA Detection Rule
The following YARA rule from Check Point Research detects the The Gentlemen locker binary:
textrule thegentlemen_ransomware {
meta:
author = "@Tera0017/Check Point Research"
description = "The Gentlemen Ransomware written in GO."
strings:
$string1 = "Silent mode (don't rename files)" ascii
$string2 = "Encrypt only mapped and UNC network shares" ascii
$string3 = "README-GENTLEMEN.txt" ascii
$string4 = "gentlemen.bmp" ascii
$string5 = "gentlemen_system" ascii
$string6 = "[+] Encryption started. Going background..." ascii
$string7 = "[+] FULL Encryption started" ascii
condition:
uint16(0) == 0x5A4D and 4 of them
}
Defender Detection Names
| Platform | Detection Name |
|---|---|
| Microsoft Defender AV | Ransom:Win64/Gentlemen.SH!MTB |
| Microsoft Defender AV | Ransom:Win64/BlackByte.SZ!MTB (for win.exe) |
| Microsoft Defender AV | Trojan:Win32/MpTamperBulkExcl.H (PowerShell AV tampering) |
| ESET | Win64/KillAV.EA (all GentleKiller variants) |
| ESET | Win64/Agent.ITG (eb.sys rootkit driver) |
| ESET | Win64/VulnDriver.* (all abused vulnerable drivers) |
| Trend Micro | Ransom.Win64.GENTLEMAN.THHAIBE |
| Trend Micro | Trojan.Win64.KILLAV.THHBHBE |
Operator TOX IDs (From Leaked Data)
The following TOX IDs were extracted from ransomware samples, linking campaigns to affiliates:
| TOX ID | Role / Notes |
|---|---|
F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E | Administrator (zeta88 / hastalamuerte) confirmed in 4 infections |
98C132E2B20B531BE6604397D97040C1E9EB42FCE12EDF119BCE8B4031CA5C70DAF5E65FA3C3 | Most prolific affiliate 11+ campaign samples |
D2CBA43A1AF6D965432AE11487726DB84D2945CF2CD975D7774B76B54AF052418AC2E59ADA69 | Active affiliate 6 campaign samples |
D527959A7BC728CB272A0DB683B547F079C98012201A48DD2792B84604E8BC29F6E6BDB8003F | Active affiliate 3 campaign samples |
F96C481CBB0D6E7BDA49C6D68CFDB1D284354961534EDEEDA854C672B48A8D6B7146F90BDACB | Active affiliate |
2F1A9C8B8AA163BBB84FF799A0954B232C279C5E9EE42505955288EAAD28685A2BC0713C7745 | Active affiliate 2 campaign samples |
15CE8D5DB0BAC3BCBB1FA69F2E672CC54EFBEC7684DA792F3CBF8B007A9FEA1D16374560DFA5 | Active affiliate |
88984846080D639C9A4EC394E53BA616D550B2B3AD691942EA2CCD33AA5B9340FD1A8FF40E9A | Active affiliate |
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Implementation |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | CVE-2024-55591 FortiOS, CVE-2025-32433 Erlang SSH |
| Initial Access | T1078 | Valid Accounts | Brute-forced / infostealer-sourced VPN credentials |
| Execution | T1059.001 | PowerShell | Defender disabling, Defender exclusion abuse, lateral movement blobs |
| Execution | T1059.003 | Windows Command Shell | GentleKiller console execution |
| Execution | T1047 | WMIC | WMIC-based remote process creation for lateral movement |
| Execution | T1053.005 | Scheduled Tasks | gentlemen_system, UpdateSystem, UpdateUser, WindowsConnSvc |
| Execution | T1106 | Native API | DeviceIoControl calls to BYOVD kernel drivers |
| Persistence | T1136 | Create Account | New domain/local accounts created by operators |
| Persistence | T1543.003 | Windows Service | Driver installation as Windows service; DefSvc, UpdateSvc |
| Persistence | T1547.001 | Registry Run Keys | GupdateS, GupdateU Run key persistence |
| Persistence | T1574 | Hijack Execution Flow | BYOVD driver hijacking execution flow to kernel |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation | CVE-2025-7771 via ThrottleBlood.sys |
| Defense Evasion | T1562.001 | Disable or Modify Tools | GentleKiller, HexKiller, ThrottleBlood, HavocKiller, EDRStartupHinder |
| Defense Evasion | T1562.009 | Safe Mode Boot | ETW patching, NTDLL unhooking (noted in post-leak locker upgrade) |
| Defense Evasion | T1070.001 | Clear Windows Event Logs | System, Application, Security logs cleared via wevtutil |
| Defense Evasion | T1070.004 | File Deletion | Prefetch, Defender logs, PowerShell history removed |
| Defense Evasion | T1036 | Masquerading | EDR killers impersonate Kaspersky, Valorant, FACEIT, Symantec, etc. |
| Defense Evasion | T1036.001 | Invalid Code Signature | Copied invalid signatures from legitimate executables |
| Defense Evasion | T1027 | Obfuscated Files | Enigma/Themida packers; Garble Go obfuscation for locker |
| Defense Evasion | T1112 | Modify Registry | Tampers with registry for anonymous SMB access and AV disabling |
| Credential Access | T1003.001 | LSASS Memory | KslDump, KslKatz, Velociraptor LSASS collection |
| Credential Access | T1003.003 | NTDS | ntds.dit extraction via buildx641/OxideHarvest |
| Credential Access | T1557.001 | NTLM Relay | RelayKing with CVE-2025-33073 |
| Discovery | T1082 | System Information Discovery | OS/environment enumeration pre-encryption |
| Discovery | T1135 | Network Share Discovery | Drive letters A–Z probed; WMI volume queries |
| Discovery | T1069 | Permission Groups Discovery | AD group enumeration via NetExec/BloodHound integration |
| Lateral Movement | T1021 | Remote Services | RDP, WinRM, SMB, PsExec lateral movement |
| Lateral Movement | T1570 | Lateral Tool Transfer | Binary staging via C$ share and hidden share$ |
| Lateral Movement | T1484.001 | GPO Modification | Domain-wide ransomware deployment via GPO/NETLOGON |
| Collection | T1560 | Archive Collected Data | Large-volume data exfiltration (hundreds of GB to TBs) |
| Exfiltration | T1048 | Exfiltration Over Alternative Protocol | WinSCP encrypted data transfer |
| Exfiltration | T1567 | Exfiltration to Cloud | Cloudflare tunnels used for covert exfiltration |
| Impact | T1486 | Data Encrypted for Impact | Curve25519 + XChaCha20 per-file encryption |
| Impact | T1490 | Inhibit System Recovery | VSS deletion via vssadmin and wmic |
| Impact | T1561 | Disk Wipe | Free space wiping with random data (--wipe flag) |
| Impact | T1491 | Defacement | Desktop wallpaper changed to gentlemen.bmp |
Defensive Recommendations
Immediate Priority Actions
- Patch CVE-2024-55591 urgently FortiOS authentication bypass is The Gentlemen’s primary initial access vector. Audit all internet-facing FortiGate, FortiProxy, and FortiSwitch devices and apply Fortinet’s patches immediately. Force credential resets on all VPN accounts.
- Block all 8 GentleKiller drivers and 3 third-party EDR killer drivers Use Microsoft’s Vulnerable Driver Blocklist and Windows Defender Application Control (WDAC). Audit against the complete driver list:
eb.sys,nseckrnl.sys,vgk.sys,stpm_old.sys,stpm_new.sys,dmx.sys,360netmon_wfp.sys,IMFForceDelete,G11.sys,googleApiUtil64.sys,ThrottleBlood.sys,havoc.sys. - Enable HVCI (Memory Integrity / Hypervisor-Protected Code Integrity) HVCI prevents unsigned and vulnerable kernel drivers from loading, blocking the BYOVD attack vector at the hardware level.
- Alert on Sysmon Event ID 6 (Driver Loaded) Log all driver loads with hash and SignatureStatus. Cross-reference against the LOLDrivers list and the Gentlemen-specific driver hashes above.
- Mandate phishing-resistant MFA on all VPN/RDP/OWA endpoints The group actively brute-forces and credential-stuffs these services. Eliminate single-factor authentication on all external-facing infrastructure.
Detection Rules (SIEM/EDR Alerts)
| Alert Priority | Detection | Rationale |
|---|---|---|
| Critical | Scheduled task gentlemen_system created | Confirmed precursor to SYSTEM-privileged encryption |
| Critical | vssadmin.exe delete shadows or wmic shadowcopy delete | Shadow copy deletion immediate ransomware indicator |
| Critical | Security, System, Application event logs cleared | Observed in 100% of documented incidents |
| Critical | Loading of driver from GentlemenCollection\ directory | Direct staging indicator |
| High | Multiple Sysmon EID 6 (driver loads) with non-Microsoft certificates | BYOVD attack in progress |
| High | Set-MpPreference -DisableRealtimeMonitoring $true via PowerShell | Defender disabling observed in every incident |
| High | Add-MpPreference -ExclusionPath C:\ | Exclusion of entire C: drive from AV scanning |
| High | svchost32.exe connecting outbound over SOCKS (ports 44729, 37182) | Known C2 beacon masquerading as system process |
| High | GPO creation with unknown executable as startup script | Domain-wide ransomware deployment precursor |
| High | Outbound Cloudflare WARP tunnel from non-IT endpoints | Pre-encryption staging behavior |
| Medium | Bulk NTLM relay scanning from internal hosts (RelayKing signatures) | Pre-encryption network reconnaissance |
| Medium | EDRStartupHinder or gfreeze process names detected | Startup EDR evasion tools |
| Medium | New shares created: share$ on C:\Temp | Lateral movement staging share |
Architecture and Hardening
- Implement strict IT/OT network segmentation The Gentlemen’s worm propagation exploits flat networks; segmentation is the single most effective containment control
- Protect backups with immutability The group actively targets Veeam, backup services, and NAS devices. Offline, immutable, air-gapped backups are mandatory
- Enable EDR Tamper Protection Use vendor-specific tamper protection with Anti-exploit Protection to prevent process termination by EDR killers
- Restrict domain controller NETLOGON share access Alert on unauthorized NETLOGON/SYSVOL modifications, as GPO-based deployment uses this vector
- Deploy deception technologies Honeyfiles and honeytokens on critical file shares detect reconnaissance activities early
- Monitor LSASS access Alert on Velociraptor, KslDump, or any unexpected process accessing LSASS memory
- Restrict anonymous SMB access Harden LSA registry settings (RestrictAnonymous, RestrictAnonymousSAM) that the encryptor attempts to disable
- Block tool binaries Consider blocking NetExec, RelayKing, PrivHound, TaskHound, CertiHound at perimeter and endpoint levels
On May 4, 2026, the Gentlemen RaaS administrator publicly acknowledged an internal breach of their “Rocket” backend database. The leak, sold by actor n7778 for $10,000 in Bitcoin, contained approximately 16.22 GB of operational data, with 44.4 MB publicly released as proof. The exposed data included:
- 3,366 Rocket.Chat internal messages across channels:
general,INFO,TOOLS,PODBOR - 9 named operator accounts and their roles
- 1,570+ victims on one affiliate’s C2 botnet
- Bitcoin laundering chains and payout records
- Live FortiGate tracking dashboard showing active targets
- Full toolchain including EDRStartupHinder, gfreeze, and EDR killer collections
- Ransom negotiation transcripts ($250k initial → $190k settled)
- Shadow file with password hashes for all internal server accounts
Despite the breach, the group maintained operational continuity, dismissed the leak, and announced technical upgrades to their locker (NTDLL unhooking, hardware breakpoint removal, ETW patching).
