The Gentlemen Ransomware

The Gentlemen does not depend on novel exploitation. Access comes through the network edge: internet-facing appliances, SSL-VPNs, and remote management interfaces, plus valid accounts and credentials purchased from initial-access brokers. KrebsOnSecurity reports the operator directly supplies affiliates with SSL-VPN credentials gathered through brute force or drawn from the group's own datasets.

One well-documented edge-device vector is CVE-2024-55591, an authentication bypass in FortiOS and FortiProxy that lets an unauthenticated attacker reach super-admin privileges. CISA lists it in the Known Exploited Vulnerabilities catalog, and it has been used to create rogue administrator accounts and pivot into internal networks. Because entry uses valid sessions and legitimate management paths, the strongest early signals are on the edge device itself: new admin accounts, configuration changes, and VPN logins that do not match normal patterns.

For defenders, the practical takeaway is that perimeter telemetry and identity monitoring matter as much as endpoint detection. By the time the encryptor runs, the attacker already holds valid credentials and often domain-level control.

The payload is a Go binary controlled entirely through command-line arguments. Microsoft documents that it validates a build-specific --password value against a hardcoded string before doing anything. A wrong password prints bad args and exits, which frustrates automated sandbox detonation and keeps recovered samples from running without operator input.

Operators choose scope and speed with flags. --full relaunches the binary as two processes, one with --system to encrypt local drives as SYSTEM and one with --shares for mapped and UNC shares. Speed flags control how much of large files are touched, from a default of roughly 27 percent down to under 1 percent for the fastest mode, while files 1 MB and smaller are always fully encrypted. A representative privilege-escalation and evasion sequence looks like this:

schtasks /create /tn gentlemen_system /ru SYSTEM /tr "<payload> --password <pw> --system"
powershell Set-MpPreference -DisableRealtimeMonitoring $true
powershell Add-MpPreference -ExclusionPath "C:\"
vssadmin delete shadows /all /quiet
wevtutil cl System & wevtutil cl Application & wevtutil cl Security

Everything is driven by trusted, built-in tooling: PowerShell, schtasks, wmic, sc, and an embedded copy of PsExec. There is no exploit to detect at this stage, which is why command-line content and parent-child relationships carry more signal than file reputation alone.

Before encryption begins, the encryptor runs a defense-evasion routine. Microsoft documents that it disables Defender real-time monitoring, adds its own executable and the entire C:\ volume to the exclusion list, then terminates a large set of running processes and Windows services. The kill lists cover categories rather than any single product: database engines, backup and recovery agents, endpoint protection services, virtualization, mail and office applications, and remote access tools. Terminating these frees file locks so more data can be encrypted and removes the very tools that would otherwise detect or reverse the attack.

It then attacks the forensic record. Volume Shadow Copies are deleted with both vssadmin and wmic. The System, Application, and Security event logs are cleared with wevtutil. Prefetch files, security diagnostic logs, remote-desktop logs, and PowerShell command history are removed. When self-propagation is enabled, a similar evasion command is pushed to each remote target to weaken it before payload delivery, including disabling the firewall across all profiles and loosening anonymous-access settings.

Independent reporting also describes operator use of vulnerable-driver abuse to kill endpoint agents from the kernel. Treat that as a related capability rather than a confirmed behavior of the encryptor sample analyzed here, and see the verification note in References.

For each file, the malware takes ownership with takeown, grants full control to Everyone with icacls, and clears read-only attributes with attrib so nothing blocks the write. Microsoft documents a hybrid scheme: a unique ephemeral Curve25519 key pair per file, an ECDH shared secret with the operator's embedded public key, and XChaCha20 for the stream cipher. The ephemeral public key is stored in a footer alongside a GENTLEMEN marker, so decryption needs the operator's private key and cannot be brute-forced per file.

Files 1 MB and smaller are fully encrypted. Larger files are partially encrypted in three chunks at distributed offsets, enough to corrupt structure while keeping speed high. Encrypted files gain the .umc16h extension. To preserve system stability and the payment path, the encryptor skips core Windows directories, executable and system file types, and its own ransom note.

After encryption, if not run in silent mode, it writes %TEMP%\gentlemen.bmp and sets it as the wallpaper, then drops README-GENTLEMEN.txt into scanned directories. Optional --wipe fills free space with random data in 64 MB blocks to defeat file-carving recovery, and a self-delete batch script removes the binary unless --keep is set. Because recovery is deliberately dismantled on-host, offline and immutable backups are the control that actually preserves recovery options.

Self-propagation is the defining feature. With the --spread argument, the infected host turns into a distribution point. It copies the binary to C:\Temp, publishes a hidden SMB share named share$ configured for anonymous access, and either extracts an embedded PsExec or downloads it from the Sysinternals Live service. It then enumerates reachable workstations, servers, and domain controllers.

Against each target it attempts 21 independent remote-execution operations, each tried regardless of whether earlier ones failed. These span remote file copy over C$, PsExec execution, WMIC process creation, user-context and SYSTEM-context scheduled tasks, Windows services, PowerShell remoting through WinRM, and direct PowerShell WMI process creation. Payloads run from either the source host's share$ or the target's staged C:\Temp copy.

• Remote scheduled tasks named DefU, UpdateGU, and UpdateGU2 in user context, repeated in SYSTEM context
• Remote services named DefSvc, UpdateSvc, and UpdateSvc2 running as SYSTEM
• A PowerShell evasion command executed on each target first to disable Defender, drop the firewall, and enable SMB1 before payload launch

The redundancy is the point. In a hardened environment where most techniques are blocked, one working path on one more host is enough to keep the encryption spreading. Detection therefore benefits from correlating a single host that suddenly creates tasks, services, and SMB writes across many peers in a short window.