The Gentlemen Ransomware

The Gentlemen is a ransomware operation first observed in mid-2025. The group operates a double-extortion model, encrypting victim files while exfiltrating sensitive data to maximise ransom pressure. The Gentlemen maintains a Tor-based Data Leak Site (DLS) where victim profiles are published alongside a staged countdown mechanism and direct TOX messenger negotiation channels.

The targeting pattern indicates a deliberate focus on medium-to-large enterprises with complex Active Directory environments and high-value data assets.

Detailed Tactics, Techniques, and Procedures (TTPs)

1. Initial Access (Internet-Facing Service Exploitation)

The Gentlemen gains initial access primarily through exploitation of internet-facing services, specifically FortiGate firewall admin panels and VPN interfaces, as well as through the use of compromised administrative credentials. No evidence of mass phishing campaigns or drive-by download delivery has been publicly documented for this group.

2. Reconnaissance & Discovery

Upon achieving access, The Gentlemen performs systematic Active Directory and network reconnaissance. Advanced IP Scanner is deployed for network mapping and infrastructure enumeration. A custom batch script enumerates user accounts, including domain admins, enterprise admins, custom privilege groups (itgateadmin), and VMware administrator groups. This targeted enumeration of virtualisation management groups is consistent with preparation for ESXi-specific encryption deployment. Domain trust discovery is performed to map trust relationships across the domain.

3. Privilege Escalation

Privilege escalation is achieved through two primary mechanisms. First, PowerRun.exe, a legitimate privilege escalation utility, is used to bypass UAC and gain SYSTEM-level privileges. Second, CVE-2025-7771, a high-severity code execution and privilege escalation vulnerability in the ThrottleStop driver, is exploited for kernel-level access.

4. Defence Evasion (BYOVD & AV/EDR Termination)

The Gentlemen employs a sophisticated Bring Your Own Vulnerable Driver (BYOVD) technique as its primary defence evasion mechanism. ThrottleStop.sys, a legitimate but vulnerable driver, is renamed to ThrottleBlood.sys and loaded to exploit CVE-2025-7771.

Our analysis confirmed that the tools were adapted mid-campaign based on the victim’s specific security stack, Allpatch2.exe dynamically targets specific security agents rather than using a static kill list.

Additionally, Windows Defender is disabled via PowerShell and exclusions are added globally across all volumes. No compiler-level obfuscation has been reported in the ransomware binary itself; defence evasion relies on the password-protected execution model and kernel-level AV termination rather than binary obfuscation.

5. Lateral Movement

Lateral movement is achieved through multiple channels. PsExec is deployed over SMB admin shares for remote command execution. AnyDesk is installed as a persistent Windows service providing a remote access backdoor. PuTTY is used for SSH-based lateral movement, particularly relevant for reaching Linux and ESXi infrastructure. RDP sessions are enabled by modifying Windows Firewall rules and setting the DisableRestrictedAdmin registry key to 0. The combination of RDP, SSH, and legitimate remote management tools demonstrates an operator philosophy of leveraging trusted administrative channels to blend with normal network activity.

6. Data Collection & Exfiltration (Double-Extortion Preparation)

Before encryption is triggered, data is exfiltrated to support the double-extortion model. Data from the local system and network shares is harvested across sensitive directories and staged locally before exfiltration. WinSCP is used for encrypted data transfers over SFTP/SCP channels. The specific volume of data exfiltrated per victim has not been independently quantified in public reporting. The exfiltration phase is assessed to occur over a period of days to weeks, depending on network size and data volume, though this timeline has not been confirmed by incident response reports and should be treated as an analytical estimate based on comparable RaaS operations.

MITRE ATT&CK TTP Matrix

The table below summarises The Gentlemen’s tactics and techniques mapped to the MITRE ATT&CK framework:

Indicators of Compromise (IOCs)

Infrastructure / C2:

• TOR Leak Site (Negotiation):

tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion

• TOR Data Leak Site (DLS):

25swr3rgce7elyedjmmhdw4ourgtxc72mj2cynsrqz6wwitestfpiiyd.onion

Communication Identifiers:

• TOX ID: F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E
• Extension: .7mtzhh (primary); .ojuopo (observed in separate campaigns)
• Ransom Note: README-GENTLEMEN.txt
   

• BYOVD Driver: ThrottleBlood.sys (renamed from ThrottleStop.sys; exploits CVE-2025-7771)
• AV Killer Tools: All.exe, Allpatch2.exe
• Privilege Escalation: PowerRun.exe
• Recon Script: 1.bat
• Binary Type: Golang, cross-platform (Windows/Linux/ESXi/NAS/BSD)
   

Mitigation with CE 5.5

1. Block Tor traffic and .onion IOCs at CE SWG perimeter using DPI to sever all Gentlemen C2 communication channels.
2. Enforce CEASR application allowlisting to block unsigned Golang binaries and ThrottleStop/ThrottleBlood kernel driver loads on endpoints.
3. Deploy CE IDPS hunting rules targeting -- password execution patterns, .7mtzhh file writes, and mass service termination events.
4. Activate CESOC 24×7 MDR escalation with SOAR playbooks for automated containment of BYOVD and ransomware deployment indicators.

Ransomware Victims by Geography

The United States remains overwhelmingly the most targeted country, accounting for 59.03% of worldwide ransomware victims. This reflects a continued strategic focus on large, digitally mature economies with high revenue potential and broad attack surfaces. Canada follows at 6.61%, reinforcing North America as the primary hotspot for ransomware operations.

In Europe, the United Kingdom recorded 3.96% while France accounted for 2.64%. Other European nations, including Germany, Italy, Spain, Sweden, Switzerland, Ireland, Portugal, Austria, Luxembourg, the Czech Republic, and Denmark, each contributed smaller but notable shares, highlighting persistent ransomware exposure across the European region.

In the Asia-Pacific region, activity was distributed across multiple economies. India represented 2.2%, while Japan, Australia, and Thailand each stood at 1.32%. Additional activity was observed in Singapore, Malaysia, New Zealand, South Korea, the Philippines, Indonesia, Taiwan, and China, demonstrating the widening geographic footprint of ransomware campaigns across the region.

In the Middle East and surrounding regions, the United Arab Emirates and Turkey each accounted for 1.76%, while Saudi Arabia also registered activity. Across Latin America, victims were reported in Brazil, Mexico, Chile, Colombia, Peru, and Ecuador, indicating sustained targeting beyond North America and Europe.

African nations, including South Africa, Nigeria, and Ghana, also recorded incidents, reflecting ransomware’s continued global penetration.