Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets.
AI applications and development tools are notable targets. The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts.
Its collection scope extends to developer and cloud environments. Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.
Introduction
Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data, but also access to AI services and the environments developers use to build software. Valid credentials or session tokens could expose private conversations and development data, enable unauthorized use of paid services, or potentially be sold to provide access to compromised AI accounts. While the malware’s collection routines support these possibilities, the analysis does not confirm how its operators monetize the stolen data.
Stealer Capabilities and Targeted Applications
The Aokigahara infostealer includes common information-stealing capabilities, such as screenshot capture, clipboard collection, browser credential and cookie theft, cryptocurrency wallet data collection, and file grabbing. It also includes a clipper handler that drops a separate component for clipboard manipulation.
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft. Additional targets include password managers, VPN clients, FTP/SFTP clients, email applications, and AI development tools. The table below summarizes each handler, its targets, and any limitations identified during the analysis.
The table below lists the malware’s main capabilities and their corresponding internal function names.
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
screenshot
Captures the screen as Screenshot.jpg.
clipboard
Captures clipboard contents into Clipboard.txt.
browsers
Chromium-based browser profiles. The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza. The handler collects browser profile data, including saved login data and cookies.
firefox
Mozilla Firefox profiles: saved logins (logins.json, decrypted through NSS), key database, and cookies.
wallets
Desktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket. It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
discord
Discord’s Local Storage LevelDB files, looking for token-like strings. Output path: Messengers/Discord/Tokens.txt.
telegram
Telegram Desktop’s tdata directory.
steam
Steam configuration and login-related files: loginusers.vdf, config.vdf, and ssfn* files.
outlook
Microsoft Office Outlook profiles. The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.
vpn
OpenVPN configs (*.ovpn), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (*.conf/*.json).
ftp
FileZilla, WinSCP, CoreFTP, FlashFXP, and SmartFTP saved sites/sessions. The code formats output with host, username, and password fields.
Roblox cookies, Battle.net config, Epic Games config/logs, Riot Games client settings, Minecraft and Roblox launcher accounts/profiles, GOG Galaxy, Origin, and Ubisoft Game Launcher data.
filegraber
Files from the user’s Desktop, Documents, and Downloads, placed under Files/Documents or Files/Crypto. The handler applies configured matching criteria; I haven’t confirmed the full extension/filter list.
thunderbird
Mozilla Thunderbird profile files, archived under Mails/Thunderbird/....
websessions
Chromium browser local/session storage, which can contain web-application session data. The table includes Chrome, Chrome Beta/Canary, Edge, Edge Beta, Brave, Opera, Vivaldi, Yandex, Arc, Thorium, and Chromium.
discordforks
Discord-derived/modded clients: token-like data from their LevelDB files and files such as settings.json, config.json, storage.json, and state.json. The exact client names come from a separate table I haven’t resolved here.
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant. It also queries Windows Credential Manager.
clipper/clipper_drop
Drops a clipper component beneath C:\Microsoft\Vault using embedded data. The handler itself does not access the clipboard; it deploys the component responsible for clipboard manipulation. The targeted cryptocurrency wallets or address formats have not been confirmed.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products. Notable targets include Git credential files, files under .ssh that may contain private keys, AWS/Azure/Google Cloud credential and configuration files, and GitHub Copilot storage. It passes matching file contents to the malware’s upload routine. If usable secrets are exposed, attackers could gain access to source code repositories, cloud resources, and other development services.
AI Data Theft
The more distinctive capability is the aisessions handler, which targets AI applications and development tools. These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data. This extends the malware’s collection beyond traditional personal accounts to authentication files, session data, and configuration files associated with AI-assisted development and cloud environments.
The paths below identify the handler’s collection targets. Depending on the application, these files may contain tokens, credentials, session data, or settings; not every targeted file necessarily contains authentication secrets.
Attackers target these files because they may contain authentication tokens, API keys, cloud credentials, and session data. If valid and usable, these secrets can allow attackers to access AI services or cloud environments without entering a password, potentially exposing private conversations, source code, and other sensitive information. Compromised accounts may also be used to consume paid services, generate unauthorized charges, or support further attacks.
Anti-Analysis
The infostealer includes several known anti-analysis checks, most of which run only when their corresponding configuration flags are enabled. The results of these checks determine whether the malware continues execution. It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.
When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language. If either matches a language ID represented in the bitmask 0x6C0400C8601, the malware stops execution. The excluded language settings are listed below.
ID
Language/region
0x0419
Russian — Russia
0x0422
Ukrainian — Ukraine
0x0423
Belarusian — Belarus
0x0428
Tajik — Tajikistan
0x042B
Armenian — Armenia
0x042C
Azerbaijani (Latin) — Azerbaijan
0x0437
Georgian — Georgia
0x043F
Kazakh — Kazakhstan
0x0440
Kyrgyz — Kyrgyzstan
0x0442
Turkmen — Turkmenistan
0x0443
Uzbek (Latin) — Uzbekistan
The second configuration flag enables analysis-environment checks, including anti-debugging, virtual machine detection, and sandbox detection. The anti-debugging checks include:
Inspection of debugger-related flags in the Process Environment Block (PEB).
Queries for the process debug port and debug object.
A debug-output string check.
Inspection of hardware breakpoint registers (DR0–DR3).
The malware checks for indicators of virtualized or analysis environments, including:
Hypervisor identifiers obtained through the CPUID instruction.
Registry entries and running processes associated with virtual machine guest tools.
Firmware and System Management BIOS (SMBIOS) fingerprints.
A low number of running processes.
Suspicious usernames and computer names.
Display characteristics and available hardware resources.
The malware also checks usernames and computer names against strings commonly associated with test or analysis environments. The inspected strings include:
Additional checks monitor cursor movement and the number of running processes. These signals may help the malware identify automated analysis environments.
Configuration
The encrypted configuration blob is stored in the .stgcfg section. It begins with a four-byte magic value STGC, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.
The AES IV is stored in the .stgcfg section, while the malware derives the AES key from a specific seed using the algorithm below. The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.
"""
Author: @Tera0017/Check Point Research
"""
def decrypt_aes_key(seed: int, length: int = 32) -> bytes:
key = bytearray()
for i in range(length):
seed ^= (seed >> (8 * (i & 3))) & 0xFF
seed = (seed * 0x01000193) & 0xFFFFFFFF
seed ^= seed >> 16
key.append(seed & 0xFF)
return bytes(key)
The decrypted configuration contains the command-and-control (C&C) URL, the server’s X25519 public key, a build ID, and a gate token used for communication. It also includes a module bitmask that controls which capabilities are executed, flags for language and analysis-environment checks, TLS certificate pinning settings, and up to three fallback URLs.
The malware uses the module_mask bitmask in its configuration to control which built-in capabilities are executed. Each entry in the module-dispatch table contains a function pointer and an associated feature mask. During dispatch, the malware performs a bitwise AND between module_mask and the entry’s feature mask. A nonzero result selects the corresponding function for execution.
All module implementations remain embedded in the executable, even when disabled in the configuration.
Network
The malware retrieves its C&C connection settings from the decrypted configuration. It uses the /gate path as the base for three endpoints that handle session establishment, stolen data uploads, and session completion.
Path
Description
/gate/handshake
Establishes an upload session by sending the client’s raw 32-byte X25519 public key. The malware requires an HTTP 200 response before enabling uploads.
/gate/chunk
Uploads collected information packaged into ZIP archives and encrypted using AES-256-GCM. Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag. Headers identify the upload label and sequence number.
/gate/complete
Signals the end of the upload phase by sending the eight-byte marker COMPLETE. The malware expects an HTTP 200 response and subsequently performs local session cleanup. This notification does not independently establish that every upload succeeded.
The stealer generates an X25519 key pair consisting of a public key and a private key. It then computes a shared secret using its private key and the server_x25519_public_key stored in the decrypted configuration. The malware derives the communication encryption key from this shared secret using SHA-256 and the fixed string aokigahara. The resulting 32-byte key is used for AES-GCM encryption.
/handshake
The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body. The request headers include the build ID, gate token, session ID, hardware identifier, and key exchange algorithm.
For each executed collection module, the malware uploads an AES-GCM-encrypted ZIP archive to /gate/chunk. The X-Chunk header identifies the type of stolen data, using module labels such as sysinfo, browsers, firefox, or aisessions. The X-Chunk-Index header identifies the upload’s sequence number, which is also included in the request body.
The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes. The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes. The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.
After uploading all ZIP archives, the malware sends a final HTTP POST request to /gate/complete on the C&C server. The request body contains the eight-byte message COMPLETE, indicating that the upload process has finished.
The stealer appears to be under active development, with changes to its HTTP User-Agent string observed across versions. The latest analyzed samples use Microsoft-CryptoAPI/10.0 for communication with the server.
Conclusion
The malware retains the broad collection capabilities expected of an infostealer, but its dedicated targeting of AI applications and developer tools is particularly notable. By collecting authentication files, application storage, Git credentials, SSH-related files, and cloud configuration data, it reaches beyond traditional consumer accounts into AI-assisted development and cloud environments.
The targeting of AI sessions creates a potential route to monetization through unauthorized use of paid services or the resale of compromised access. It may also create opportunities for data extortion. Users can share sensitive business information, proprietary source code, and other confidential material with AI services. If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment.
The key finding is that AI application credentials and session data are part of this malware’s collection scope and should be treated as sensitive assets alongside browser sessions, cloud credentials, and developer keys.
The Gentlemen ransomware‑as‑a‑service (RaaS) program is rapidly gaining popularity, attracting numerous affiliates and publicly claiming over 320 victims, with the majority of attacks (240) occurring in the first months of 2026.
The service provides a broad locker portfolio implemented in Go for Windows, Linux, NAS, and BSD, plus an additional locker written in C for ESXi, enabling coverage of the multiple platforms commonly found in corporate environments.
During an incident response engagement, an affiliate associated with The Gentlemen attempted to deploy SystemBC, a proxy malware frequently leveraged in human‑operated ransomware operations for covert tunneling and payload delivery.
Check Point Research observed victim telemetry from the relevant SystemBC command‑and‑control server, revealing a botnet of over 1,570 victims, with the infection profile strongly suggesting a focus on corporate and organizational environments rather than opportunistic consumer targeting.
The Gentlemen RaaS
The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple underground forums, promoting their ransomware platform and inviting penetration testers (and other technically skilled actors) to join as affiliates.
Figure 1 — The Gentlemen post on underground forums.
The RaaS provides affiliates with multi‑OS lockers for Windows, Linux, NAS, BSD implemented in Go, and an additional locker for ESXi implemented in C. The group also grants verified partners access to EDR‑killing tools and its own multi‑chain pivot infrastructure (server and client components).
The group maintains an onion site where it publishes data stolen from victims who refuse to pay. Negotiations, however, are not conducted through this leak portal but via the individual affiliate’s Tox ID. Tox is a free, decentralized, peer‑to‑peer (P2P) instant messaging protocol that provides end‑to‑end encrypted voice, video, and text communication.
The group also appears to maintain a Twitter/X account, which is referenced in the ransomware note. Through this account, the operators publicly post about victims, likely to increase pressure on them to pay.
Figure 2 — The Gentlemen RaaS X/Twitter account.
To date, the group has publicly claimed a little over 320 victims, with the majority of infections occurring in 2026. This growth in activity suggests that The Gentlemen RaaS program has managed to attract a significant number of affiliates over the last few months.
SystemBC Infections
During an incident response case, an affiliate of The Gentlemen Ransomware‑as‑a‑Service (RaaS) deployed SystemBC, a proxy malware, on the compromised host. SystemBC establishes SOCKS5 network tunnels within the victim’s environment and connects to its C&C server using a custom RC4‑encrypted protocol. It can also download and execute additional malware, with payloads either written to disk or injected directly into memory.
The specific Command and Control server that was used for the communication had infected a large number of victims across the globe. It is likely that the majority of those victims are companies and organizations, given that SystemBC is typically deployed as part of human‑operated intrusion workflows rather than massive targeting.
Figure 3 — SystemBC global accesses.
There are over 1,570 victims, with the majority located in the United States, followed by the United Kingdom and Germany.
Figure 4 — Top 15 Infected countries.
Whether SystemBC is directly integrated into The Gentlemen ransomware ecosystem or is simply a tool leveraged by this particular affiliate for exfiltration and remote access remains unclear. At this time, Check Point Research has no evidence to determine the exact nature of this relationship.
Figure 5 — SystemBC infections panel.
DFIR Report – Timeline
Figure 6 – A high-level timeline of the attack
Initial Access and Establishment of Domain Control
The precise initial access vector could not be conclusively determined. The earliest stage of adversary activity that can be established with confidence is the attacker’s presence on a Domain Controller with Domain Admin–level privileges. From that position, the attacker appears to have performed systematic credential validation and host accessibility testing across the environment, as reflected in an initial pattern of failed network logons followed by successful authentications originating from the Domain Controller. This sequence is consistent with a controlled effort to verify privileged access and identify viable systems before expanding operations more broadly.
Remote Execution and Early Discovery
Using this privileged position, the attacker deployed Cobalt Strike payloads to remote systems by writing executables to administrative shares such as \\\\[REDACTED_HOSTNAME]\\ADMIN$\\<random_7_char>.exe and executing them via RPC. The first observed deployment occurred on an internal endpoint, after which similar activity appeared across additional hosts. Early post-compromise actions included reconnaissance commands such as cmd.exe /C systeminfo, cmd.exe /C whoami, and enumeration commands like cmd.exe /C dir c:\\users. The attacker also accessed internal documentation via cmd.exe /C type \\\\[REDACTED_HOSTNAME]\\d$\\...\\公司主機紀錄.txt, indicating use of environment-specific knowledge in addition to automated discovery. Expansion to other systems followed quickly, with repeated execution artifacts such as regsvr32.exe across multiple hosts confirming centrally driven activity.
Command-and-Control and Payload Staging
As execution expanded, the attacker attempted to establish additional command-and-control capabilities. On one compromised host, it staged the tool socks.exe – identified as a variant of SystemBC – was executed and attempted to communicate with 45.86.230[.]112, followed by validation using cmd.exe /C tasklist | findstr /i socks. This tool is commonly used to create SOCKS-based proxy channels for covert communication and internal pivoting. In this instance, however, the activity was blocked by endpoint protection. Shortly thereafter, a remotely executed payload (<random_7_char>.exe) spawned c:\\windows\\system32\\rundll32.exe, which established outbound communication to 91.107.247[.]163 Cobalt Strike C&C over ports 443 and later 80, indicating successful external command-and-control connectivity through alternative infrastructure.
At the same stage, PowerShell was executed from a scheduled task context using:
This command downloaded grand.exe (the ransomware encryptor) from an internal staging server (DC) and executed it as c:\\programdata\\r.exe. The arguments --password VvO8EtUh and --spread [REDACTED_DOMAIN]\\[REDACTED_USER]:[REDACTED_PASSWORD] indicate both controlled execution and built-in propagation capability, marking a transition from initial access to coordinated malware deployment.
Defense Evasion, Propagation, and Persistence
Following execution of the staged payload, the attacker attempted to weaken host defenses using:
This disabled Windows Defender real-time monitoring. The same payload, identified by a consistent hash, then appeared across numerous systems under different filenames, including c:\\programdata\\r.exe, c:\\programdata\\g.exe, and c:\\programdata\\o.exe. This demonstrates rapid internal propagation via a shared malware component, supported by both domain-level access and the built-in spreading mechanism described earlier.
In parallel, the attacker performed environmental checks using commands such as:
cmd.exe /C wmic product where Name like '%kaspe%' get Name, IdentifyingNumber
Later, repeatedly executed across multiple hosts:
cmd.exe /C gpupdate /force
These attempts suggest the threat actor tried to influence or validate policy state during propagation. Remote Desktop was then enabled through commands such as:
cmd.exe /C reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0 /f
cmd.exe /C netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
Later, the attacker installed and configured AnyDesk using:
This established a persistent remote access channel with a predefined password (Camry@12345), adding a secondary access mechanism after the SystemBC attempt was blocked.
Credential Access and Continued Discovery
Compromised hosts were also used for credential harvesting. Mimikatz output recovered from memory on one of the compromised endpoints showed access to credential material, including domain accounts and stored credentials from Credential Manager. This confirms that credential access occurred alongside lateral movement and malware deployment.
At the same time, the attacker continued discovery operations using commands such as:
cmd.exe /C query session
cmd.exe /C nltest /domain_trusts
cmd.exe /C nltest /dclist
cmd.exe /C net group "Domain Admins" /domain
cmd.exe /C net group "Enterprise Admins" /domain
These commands indicate enumeration of active sessions, domain trust relationships, domain controllers, and privileged groups, reflecting a shift toward understanding and potentially controlling the broader domain structure.
Consolidated View of the Intrusion
Taken together, the attack progressed from suspected perimeter access to domain-level control, followed by credential validation, remote payload execution via ADMIN$ shares, and rapid expansion across endpoints. This was accompanied by attempted and successful command-and-control establishment using infrastructure such as 45.86.230[.]112 and 91.107.247[.]163, staged malware delivery from the internal DC, and widespread propagation of a shared payload under multiple filenames. Defensive measures were actively suppressed, and multiple persistence and exfiltration mechanisms were introduced, including RDP and AnyDesk.
The failed deployment of SystemBC and the subsequent reliance on alternative channels demonstrate that the attacker adapted their approach when blocked. Overall, the activity reflects coordinated, centrally controlled execution with layered access mechanisms, resulting in broad, durable control over the environment.
Impact
The intrusion culminated in the deployment of The Gentlemen RaaS payload by an affiliate, using Group Policy as the distribution mechanism. A GPO‑based deployment was configured so that the ransomware binary was executed on domain‑joined systems during policy refresh, resulting in a rapid, near‑simultaneous encryption event across the environment.
The Gentlemen GO Ransomware
The Gentlemen ransomware is developed in the Go programming language. It appears to be under active development, with new features and capabilities being continuously added over time.
Command Line Arguments
The Gentlemen ransomware exposes a wide range of command‑line options that provide numerous features to its operators. While most flags are optional, the only mandatory argument required to start the encryption process is --password, which appears to be unique per build/infection.
Usage: %s --password PASS [--path DIR1,DIR2,...] [--T MIN] [--silent] [--wipe] [--keep] [--full/system/shares] [--gpo/spread] [--fast/superfast/ultrafast]
Main Flags
--password PASS Access password (required)
--path DIRS Comma-separated list of target directories/disks (optional)
--T MIN Delay before start, in minutes (optional)
Mode Flags (cant be mixed)
--system Run as SYSTEM: encrypt only local drives (optional)
--shares Encrypt only mapped network drives and available UNC shares in session context (optional)
--full Two-phase: --system + --shares. Best practice. (optional)
Additional Flags
--spread CREDS Lateral movement: "domain/user:pass" with creds, or "" for current session
--gpo Deploy via Group Policy to all domain computers (run on DC)
--silent Silent mode: do NOT rename and modify time of files after encryption, no wallpaper(optional)
--keep Do not selfdelete after encryption (optional)
--wipe Wipe free space after encryption (optional)
Speed Flags (cant be mixed)
--fast 9 percent crypt. (optional)
--superfast 3 percent crypt. (optional)
--ultrafast 1 percent crypt. (optional)
Example 1: --password QWERTY --path "C:\\,D:\\,\\\\nas\\share" --T 15 --silent
Example 2: --password QWERTY --system --fast
Example 3: --password QWERTY --shares --T 10
Example 4: --password QWERTY --full --ultrafast
Example 5: --password QWERTY --full --spread "domain\\admin:P@ss" # With credentials
Example 6: --password QWERTY --T 10 --keep --spread "" # Current session
Example 7: --password QWERTY --gpo --full --fast
[+]
The minimum required command‑line for The Gentlemen ransomware execution is:
$process_name --password $pass
The password is plaintext hardcoded in the binary validates it with the password provided in the required argument.
During execution, the ransomware attempts to establish persistence using multiple mechanisms. It first attempts to create a scheduled task, initially without validating the current process privileges:
The second local persistence method relies on a Run registry key. As with scheduled tasks, the malware attempts to configure this both for the system (HKLM) and for the current user (HKCU):
When the --spread argument is enabled, the ransomware also attempts to maintain remote persistence on each reachable host. For each target, it sets up two persistence mechanisms:
Scheduled tasks–based persistence
Service–based persistence
Both mechanisms attempt to execute the ransomware from different locations on the remote machine or over a share.
*Full command lines for the --spread argument are provided further below.
Antivirus Evasion
The ransomware executes three PowerShell commands to disable Microsoft Defender protection and exclude both itself and the entire C:\\ drive from scanning and monitoring:
powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true -Force, disables Defender’s real-time protection entirely, the background scanning that monitors files, downloads, and processes as they’re accessed. With this off, malware can run without being intercepted.
powershell -Command Add-MpPreference -ExclusionProcess <ransomware_exe> -Force, adds a specific executable to Defender’s process exclusion list. Defender will completely ignore any file activity triggered by that process, even if it’s doing something malicious.
powershell -Command Add-MpPreference -ExclusionPath C:\\ -Force, adds the entire C: drive to Defender’s path exclusion list. This tells Defender to skip scanning anything on the drive, every file, folder, and executable.
During lateral movement, the ransomware makes an attempt to blind Windows Defender on each reachable remote host by pushing a PowerShell script that disables real-time monitoring, adds broad exclusions for the drive, staging share, and its own process, shuts down the firewall, re-enables SMB1, and loosens LSA anonymous access controls, all before deploying and executing the ransomware binary on that host.
The ransomware tries to disable the firewall to allow unrestricted outbound and inbound traffic. This enables lateral movement tools (PsExec, WMI, SMB) to reach remote hosts without firewall rules blocking them, and allows exfiltration channels to operate freely. Bellow the executed commands deactivating the firewall:
The --spread argument is disabled by default and is assigned the value "DISABLED". The lateral movement phase is only activated when the operator explicitly supplies --spread "domain\\user:password", providing credentials harvested from the environment.
These credentials are then reused across all lateral movement operations: PsExec receives them via the -u and -p parameters, WMI uses them for remote authentication, and remote scheduled task and service creation, authenticating with them against each target host.
Once --spread is enabled, the ransomware enumerates all domain computers via Active Directory, pings each discovered host to confirm reachability, and, for every host that responds, executes the full lateral movement sequence: copying the binary, pushing the Defender‑disabling script, and deploying it through six parallel execution channels across PsExec, WMI, scheduled tasks, and services.
The --gpo flag enables the most powerful and far-reaching deployment method in the entire binary, reserved specifically for operators who have already compromised a Domain Controller. It is designed to weaponize Active Directory’s own Group Policy infrastructure to detonate the ransomware simultaneously on every computer in the domain. When --gpo is enabled, the following PowerShell script is executed:
In order to enumerate network drives the ransomware executes a sequence of Windows commands that force-enable network discovery and related services, making the machine visible and reachable on the local network.
Then loads dynamically mpr.dll and by using the Windows API functions enumerates the networks shares:
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
Directories, Filenames and Extensions Exclusion
As with many other ransomware families, this one also excludes specific directories, filenames, and file extensions from encryption, ensuring that the system remains at least partially usable after the attack.
During execution, the ransomware attempts to delete shadow copies, which are a primary mechanism for recovering encrypted files:
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
rd /s /q C:\\$Recycle.Bin
In addition to shadow copies, the ransomware also deletes various log files. These logs typically contain authentication events, process and service creation events, and traces of lateral movement. The destruction of these artifacts clearly aims to remove forensic evidence of the intrusion and hinder post-incident investigation.
wevtutil cl System
wevtutil cl Application
wevtutil cl Security
del /f /q C:\\Windows\\Prefetch\\*.*
del /f /q C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*
del /f /q %SystemRoot%\\System32\\LogFiles\\RDP*\\*.*
Free Space Wiping
When the threat actor executes the ransomware with the --wipe argument, the malware additionally attempts to wipe free disk space. It creates a file named wipefile.tmp on each targeted drive and writes 64 MB chunks of data to it until all free space is exhausted. This process overwrites previously deleted file content that could otherwise be recovered using forensic tools.
Background Image Change
If the --silent argument is not specified, the ransomware replaces the desktop background with an embedded image. The image resource is written to %TEMP%\\gentlemen.bmp, and the malware then calls SystemParametersInfoW to set it as the desktop wallpaper.
File Encryption
Before encryption begins, the ransomware checks whether the file size exceeds 0x100000 (1,048,576 bytes, or 1 MB). Files of 1 MB or smaller are routed to the small file function, while files larger than 1 MB are routed to the large file function.
Regardless of size, the key derivation process is identical for both paths. The ransomware generates a random 32-byte ephemeral private key. Using X25519 (the Diffie–Hellman primitive over Curve25519), it derives two values: first, the ephemeral public key by multiplying the private key with the curve basepoint, and second, a shared secret by combining the ephemeral private key with the attacker’s public key. The ephemeral public key is not secret and will later be stored in the file, while the shared secret remains only in memory. Key material for encryption is then constructed directly from these values. The ephemeral public key is used as the 32-byte symmetric key, while the first 24 bytes of the shared secret (derived with the attacker’s public key) are used as the nonce.
For small files (less than 1MB) the contents are encrypted using XChaCha20, a stream cipher, which XORs the plaintext with a keystream to produce ciphertext of identical length. The original file is overwritten in place with this ciphertext.
For large files larger than 1 MB, the encryption process changes depending on optional speed mode arguments that control how much of the file is actually encrypted. Instead of processing the entire file, the algorithm only encrypts a small portion of it. In fast mode about 9 percent of the file is encrypted. In superfast mode about 3 percent is encrypted. In ultrafast mode only about 1 percent of the file is affected. The encrypted regions are selected across the file and processed in chunks of about 64 KB. Each chunk is read, encrypted using XChaCha20, and written back to the same position in the file. After encryption, the function appends a footer to the file containing the string --eph--, followed by the base64-encoded ephemeral public key and a newline. This is followed by a marker section --marker--GENTLEMEN\\n and a final GENTLEMEN sentinel. The stored ephemeral public key allows the attacker, who possesses the corresponding private key, to recompute the shared secret and reconstruct the nonce, enabling decryption of the file. If any of the speed-increasing arguments (fast, superfast, or ultrafast) were specified during large file encryption, the selected argument is also appended to the end of the file.
The attacker’s decryptor obtains the base64 value from the header (--eph-- field), decodes it to get the ephemeral public key, and uses it directly as the ChaCha20 key. It then recomputes sharedSecret = X25519(attacker_privKey, ephemeralPubKey) using the attacker’s own private key, and uses the first 24 bytes of sharedSecret2 as the ChaCha20 nonce. With the key and nonce recovered, it decrypts the encrypted files.
The Gentlemen ESXi Variant
Latest ELF variant of The Gentlemen ransomware remains undetected by the majority of the Antivirus systems as seems in VirusTotal. The incapability to trigger and execute the malicious code due to the --password requirement possibly affects the detection results, even though for Windows samples this does not appear to be an issue.
Figure 8 — VirusTotal detection rate.
Command Line Arguments
The majority of the arguments functionalities are observed as well in the ELF variant of The Gentlemen ransomware.
Usage: %s --password PASS --path DIR [--ignore VMS] [--T MIN] [--fast] [--superfast] [--ultrafast]
Main Flags
--password PASS Access password (required)
--path DIR Target directories, comma-separated (required)
Example: --path /vmfs/
Example2: --path "/vmfs/,/datastore/,/mnt/storage"
--ignore VMS VM display names to ignore, comma-separated (optional)
Example: --ignore DomainController
Example2: --ignore "DomainController,Backup Server"
--T, --timer MIN Delay before start in minutes (optional)
Example: --T 15
Example2: --timer 15
Speed Flags (can't be mixed)
--fast Lock 9 percent of file (optional)
--superfast Lock 3 percent of file (optional)
--ultrafast Lock 1 percent of file (optional)
[+]
The ESXi variant exposes fewer functionalities than the Windows variant, as many features present in the Windows version are not required on ESXi systems.
Flag / Argument
Windows
ESXi
--password PASS
Access password (required)
Access password (required)
--path DIRS / DIR
Comma-separated list of target directories/disks (optional). Example: --path "C:\\,D:\\,\\\\nas\\share"
Target directories, comma-separated (required).
Example: --path "/vmfs/,/datastore/,/mnt/storage"
--T MIN
Delay before start, in minutes (optional)
Delay before start in minutes (optional)
--timer $MIN
Not present
Alias for delay before start in minutes (optional)
--system
Run as SYSTEM; encrypt only local drives
Not present
--shares
Encrypt only mapped network drives and UNC shares in session context
Not present
--full
Two-phase: --system + --shares (“Best practice”)
Not present
--spread $CREDS
Lateral movement: "domain/user:pass" or "" for current session
Not present
--gpo
Deploy via Group Policy to all domain computers (run on DC)
Not present
--silent
Silent mode: do not rename/retime files; no wallpaper change
The minimum required command‑line for Linux Gentlemen ransomware execution is:
$process_name --password $pass --path $path(s)
VM & Processes Termination
Ransomware operators shut down virtual machines on an ESXi host to make their attack more effective and efficient. By powering off the VMs, they release locks on virtual disk files, allowing those files to be encrypted more reliably and with less risk of interference or corruption. This also disables any security tools running inside the guest systems, reducing the chance of detection or response.
The locker performs a controlled shutdown of all virtual machines on a VMware ESXi host. It first lists all registered VMs and iterates through them to issue a graceful power-off command (optionally skipping specified VMs). After a short wait to allow clean shutdowns, it checks for any remaining running VM processes using esxcli. If any VMs are still active, it forcefully terminates them by killing their associated world processes. In effect, it ensures that all VMs are stopped, using escalation from graceful shutdown to hard kill only when necessary.
# Enumerate all registered VMs (popen, output parsed line by line)
vim-cmd vmsvc/getallvms | tail -n +2
# Power off each VM gracefully (one system() call per VM, skipping --ignore list)
vim-cmd vmsvc/power.off <vmid> > /dev/null 2>&1
# After 8-second sleep: enumerate still-running VM processes (popen)
esxcli --formatter=csv vm process list | tail -n +2
# Force-kill any remaining VM processes by world-id (one per process)
esxcli vm process kill --type=force --world-id=<world_id> > /dev/null 2>&1
Persistence
The ransomware copies itself to /bin/.vmware-authd mimicking a legitimate VMware daemon.
Adds a second persistence layer via crontab. At every reboot, after a 60-second delay, the ransomware relaunches via the hidden binary with the original arguments.
The ransomware modifies a VMware ESXi host to prepare the storage layer for fast, consistent disk writes and then disables automatic VM recovery. It increases the VMFS write buffer capacity and adjusts the flush interval to control how data is committed to disk, then forces synchronous writes across all VMFS datastores by briefly creating and deleting eager-zeroed thick disks. Finally, it clears and disables the VM autostart configuration so virtual machines will not restart automatically after a reboot.
# Maximize VMFS write buffer capacity (speeds up encryption throughput)
esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity > /dev/null 2>&1
# Reduce buffer flush interval (forces faster disk commit)
esxcfg-advcfg -s 20000 /BufferCache/FlushInterval > /dev/null 2>&1
# Create eagerzeroedthick disk on every VMFS-5 datastore (forces buffer flush before encryption — ensures plaintext is written to disk)
for I in $(esxcli storage filesystem list | grep 'VMFS-5' | awk '{print $1}'); do \\
vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk > /dev/null 2>&1; \\
vmkfstools -U $I/eztDisk > /dev/null 2>&1; \\
done 2>&1
# Same as above for VMFS-6 datastores
for I in $(esxcli storage filesystem list | grep 'VMFS-6' | awk '{print $1}'); do \\
vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk > /dev/null 2>&1; \\
vmkfstools -U $I/eztDisk > /dev/null 2>&1; \\
done 2>&1
# Clear ESXi VM autostart configuration (prevents VMs from restarting)
vim-cmd hostsvc/autostartmanager/clear_autostart > /dev/null 2>&1
# Disable autostart manager entirely
vim-cmd hostsvc/autostartmanager/enable_autostart 0 > /dev/null 2>&1
Directories, Filenames and Extensions Exclusion
The ransomware implements a targeted exclusion list to avoid encrypting critical components of the underlying VMware ESXi / Linux-based operating system, as well as associated virtualization and boot infrastructure.
The activity surrounding The GentlemenRaaS underscores how quickly a well‑designed affiliate program can evolve from newcomer to a high‑impact ecosystem player. By combining a versatile, multi‑platform locker set with built‑in lateral movement, Group Policy–based mass deployment, and strong defense‑evasion capabilities, the operation enables even moderately skilled affiliates to execute enterprise‑scale intrusions with ransomware detonation as the final stage.
The observed use of SystemBC alongside Cobalt Strike, and the discovery of a botnet with more than 1,570 likely corporate victims, further highlights that The Gentlemen affiliates are not operating in isolation, but are actively integrating into a broader toolchain of mature, post‑exploitation frameworks and proxy infrastructure. Organizations should therefore treat The Gentlemen not as an isolated family, but as part of a wider, modular intrusion ecosystem where initial access, post‑exploitation, and encryption capabilities can be rapidly recombined and reused across campaigns.
rule thegentlemen_ransomware
{
meta:
author = "@Tera0017/Check Point Research"
description = "The Gentlemen Ransomware written in GO."
strings:
$string1 = "Silent mode (don't rename files)" ascii
$string2 = "Encrypt only mapped and UNC network shares" ascii
$string3 = "README-GENTLEMEN.txt" ascii
$string4 = "gentlemen.bmp" ascii
$string5 = "gentlemen_system" ascii
$string6 = "[+] Encryption started. Going background..." ascii
$string7 = "[+] FULL Encryption started" ascii
condition:
uint16(0) == 0x5A4D and 4 of them
}
Ransomware Note – README-GENTLEMEN.txt
Windows Version:
{VICTIM_ID} {VICTIM}= YOUR ID
Gentlemen, your network has been encrypted.
1. Any modification of encrypted files will make recovery impossible.
2. Only our unique decryption key and software can restore your files.
Brute-force, RAM dumps, third-party recovery tools are useless.
It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc).
If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.
In addition, it will be reported to the relevant data protection authorities and regulators.
This may result in official investigations, significant fines, and reputational damage for your company.
6. We guarantee 100% file recovery to their original state, bit by bit.
To demonstrate the quality of our work, you can provide three sample files, and we will restore them free of charge.
TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): D527959A7BC728CB272A0DB683B547F079C98012201A48DD2792B84604E8BC29F6E6BDB8003F
Download Tox messenger: <https://tox.chat/download.html>
Contact us (add via Session ID): {SESSION_ID}
Download Session <https://getsession.org>
СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER)
Check our blog: hxxp://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/
Download Tor browser: <https://www.torproject.org/download/>
Follow us on X: hxxps://x.com/TheGentlemen25
Any other means of communication are fake and may be set up by third parties.
Only use the methods listed in this note or on the specified website.
After adding (us) in Tox or Session, please wait for your request to be processed and stay online.
If you do not receive a reply within 36 hours, create another account and contact us again.
In your first message in chat, immediately provide your ID from the note and the name of your organization.
Assign one person as contact responsible for all negotiations. Do not create multiple chats.
ESXi Version:
{VICTIM_ID} = YOUR ESXI ID
Gentlemen, your ESXI has been encrypted.
1. Any modification of encrypted files will make recovery impossible.
2. Only our unique decryption key and software can restore your files.
Brute-force, RAM dumps, third-party recovery tools are useless.
It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc).
If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.
In addition, it will be reported to the relevant data protection authorities and regulators.
This may result in official investigations, significant fines, and reputational damage for your company.
6. We guarantee 100% file recovery to their original state, bit by bit.
To demonstrate the quality of our work, you can provide two sample files, and we will restore them free of charge.
TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): D2CBA43A1AF6D965432AE11487726DB84D2945CF2CD975D7774B76B54AF052418AC2E59ADA69
Download Tox messenger: <https://tox.chat/download.html>
Contact us (add via Session ID): {SESSION_ID}
Download Session <https://getsession.org>
СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER)
Check our blog: hxxp://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/
Download Tor browser: <https://www.torproject.org/download/>
Follow us on X: <https://x.com/TheGentlemen25>
Any other means of communication are fake and may be set up by third parties.
Only use the methods listed in this note or on the specified website.
MITRE ATT&CK Matrix
Tactic
Technique / Sub‑Technique
Description
Initial Access
Valid Accounts (T1078)
Attacker already active on Domain Controller with Domain Admin privileges; --spread "domain\\user:password" uses harvested domain credentials for remote execution and lateral movement.
Initial Access
External Remote Services (T1133) (inferred)
Initial entry not directly observed; context suggests possible compromise via exposed remote services (e.g., RDP/VPN), but campaign evidence starts post‑compromise on DC.
Execution
Command Shell (T1059.003)
Widespread cmd.exe /C usage: systeminfo, whoami, dir c:\\users, type \\\\host\\share\\file.txt, taskkill, gpupdate /force, net, rd, etc.
Execution
PowerShell (T1059.001)
Defender tampering and firewall changes via PowerShell; internal HTTP download of grand.exe to c:\\programdata\\r.exe; extensive script‑based lateral movement using Invoke-Command and multi‑step PowerShell scripts (SCRIPT_A…SCRIPT_G).
Execution
Windows Management Instrumentation (T1047)
wmic /node:<target> process call create "<DEFENDER_SCRIPT_A>" and wmic ... "C:\\Temp\\<exe> <creds>" to execute scripts and lockers on remote hosts.
Execution
Scheduled Task/Job: Scheduled Task (T1053.005)
Creation of local and remote tasks: UpdateSystem, UpdateUser, DefU, DefS, UpdateGU, UpdateGU2, UpdateGS, UpdateGS2 using schtasks /Create /S <target> ... /Run for execution and persistence.
Execution
System Services: Service Execution (T1569.002)
Remote services DefSvc, UpdateSvc, UpdateSvc2 created and started via sc \\\\<target> create ... and sc \\\\<target> start ... to run ransomware or helper scripts.
Execution
Native API (T1106)
Use of SystemParametersInfoW to set gentlemen.bmp as wallpaper; dynamic loading of mpr.dll and calls to WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum to enumerate network shares.
Execution
User Execution: Malicious File (T1204.002)
Operator‑driven execution of ransomware payloads (r.exe, g.exe, o.exe, GPO‑deployed locker) on endpoints as final stage of intrusion.
Persistence
Scheduled Task/Job: Scheduled Task (T1053.005)
Local persistence via schtasks /Create /SC ONSTART /TN UpdateSystem /TR "<exe> <args>" /RU SYSTEM; remote tasks on many hosts ensure repeated execution and durability of the locker.
Persistence
Registry Run Keys / Startup Folder (T1060)
Run key added: reg add HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v GupdateU /t REG_SZ /d "<exe>" /f to autostart ransomware in user context.
Persistence
Create or Modify System Process: Windows Service (T1543.003)
Creation of new services (DefSvc, UpdateSvc, UpdateSvc2) on remote hosts to execute ransomware or helper logic, typically running as SYSTEM.
Persistence
Boot or Logon Autostart Execution: rc.local (T1547.009)
ESXi/Linux variant copies itself to /bin/.vmware-authd and configures /etc/rc.local.d/local.sh with sleep 30 && /bin/.vmware-authd <original_argv> & to auto‑run on boot.
Combined use of rc.local (/etc/rc.local.d/local.sh) and cron @reboot scripts ensures the locker relaunches after ESXi host reboot.
Persistence
Ingress Tool Transfer (T1105)
--gpo deployment mode copies locker to \\\\<domain>\\NETLOGON\\<exe> and injects ScheduledTasks.xml into GPO path; all domain machines then pull and execute the locker via GPO‑scheduled tasks.
Privilege Escalation
Valid Accounts (T1078)
Stolen Domain Admin and other domain credentials used with PsExec (-u <domain\\user> -p <pass>) and --spread to perform privileged remote execution and lateral movement.
Privilege Escalation
Scheduled Task/Job: Scheduled Task (T1053.005)
Tasks created to run as SYSTEM (/RU SYSTEM) – locally and via GPO – escalate from user to LocalSystem context for file encryption and defense evasion.
Privilege Escalation
Create or Modify System Process: Windows Service (T1543.003)
Attackers create new services configured to run under high‑privilege service accounts (usually SYSTEM) on remote hosts to execute ransomware components.
Defense Evasion
Impair Defenses: Disable or Modify Tools (T1562.001)
Defender disabled and neutered via Set-MpPreference -DisableRealtimeMonitoring $true; exclusions added for C:\\, C:\\Temp, \\\\<host>\\share$, and the ransomware process; these operations are performed locally and remotely via scripts.
Defense Evasion
Impair Defenses: Disable or Modify System Firewall (T1562.004)
Firewall disabled globally: netsh advfirewall set allprofiles state off, Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False; firewall service mpssvc is stopped and set to disabled.
Defense Evasion
Impair Defenses: Disable or Modify Cloud/Network Security (T1562.007)
Attackers enable SMB1 (Enable-WindowsOptionalFeature ... SMB1Protocol), loosen LSA anonymous access (EveryoneIncludesAnonymous=1, RestrictAnonymous=0), and set open network shares using net share + icacls, reducing network/segmentation protections.
Defense Evasion
Indicator Removal on Host: Clear Windows Event Logs (T1070.001)
wevtutil cl System, wevtutil cl Application, wevtutil cl Security executed to remove Windows event logs and hinder forensic reconstruction.
Defense Evasion
Indicator Removal on Host: File Deletion (T1070.004)
Forensic artefacts removed: prefetch (C:\\Windows\\Prefetch\\*.*), Defender logs (C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*), RDP logs (%SystemRoot%\\System32\\LogFiles\\RDP*\\*.*), $Recycle.Bin, plus overwriting free space via wipefile.tmp with 64 MB chunks.
Defense Evasion
Indicator Removal on Host: Timestomp (T1070.006) (implied)
Report notes --silent avoids file renaming and timestamp changes; default behavior implied to alter names/timestamps, hampering timeline reconstruction and signature‑based detection.
Defense Evasion
Masquerading: Masquerade Task or Service (T1036.004)
ESXi locker placed at /bin/.vmware-authd, masquerading as legitimate VMware vmware-authd daemon.
Defense Evasion
Masquerading: Match Legitimate Name or Location (T1036.005)
Ransomware components use generic names (r.exe, g.exe, o.exe) and common locations (C:\\ProgramData\\, C:\\Temp\\, admin shares) to blend with normal tools and admin activity.
ESXi binary uses a leading dot .vmware-authd to stay hidden; --silent mode on Windows avoids visible UI changes like wallpaper and renaming, running ransomware quietly in the background.
Defense Evasion
Obfuscated/Encrypted Artifacts (T1027)
Per‑file ephemeral X25519 keys and XChaCha20 encryption plus footer markers (`–eph–<base64_ephemeral_pubkey>–marker–GENTLEMEN\nGENTLEMEN[–fast
Credential Access
OS Credential Dumping (T1003)
Mimikatz artefacts recovered from memory show dumping of domain credentials and stored secrets from compromised workstations.
Credential Access
Credentials from Password Stores (T1555)
Mimikatz dumping likely includes passwords from Windows Credential Manager/password stores, used later for --spread and PsExec.
Discovery
System Information Discovery (T1082)
cmd.exe /C systeminfo run on compromised hosts to gather OS and hardware information.
Discovery
Account Discovery (T1033)
cmd.exe /C whoami to confirm identity and context on multiple hosts.
Discovery
Account Discovery: Domain Account (T1087.002)
net group "Domain Admins" /domain and net group "Enterprise Admins" /domain executed to enumerate domain‑level privileged groups.
Discovery
Domain Trust Discovery (T1482)
nltest /domain_trusts, nltest /dclist (implied) to identify domain trust relationships and domain controllers.
Discovery
Remote System Discovery (T1018)
Domain computers enumerated via Get-ADComputer -Filter *; each host pinged to confirm reachability before executing lateral movement steps.
Discovery
Permission Groups Discovery: Domain Groups (T1069.002)
net group "Domain Admins" /domain and similar commands to discover privileged group membership.
Discovery
Network Share Discovery (T1135)
mpr.dll dynamically loaded; WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum used to enumerate available network shares after enabling network discovery services.
Discovery
File and Directory Discovery (T1083)
cmd.exe /C dir c:\\users; reading internal files (e.g., Chinese language “公司主機紀錄.txt”) on file servers via UNC paths.
wmic product where Name like '%kaspe%' get Name, IdentifyingNumber executed to identify installed Kaspersky (or similar) security products.
Discovery
Network Service Scanning (T1046) (partly inferred)
While explicit port scans are not shown, large‑scale multi‑protocol lateral attempts via PsExec, WMI, remote services, and scheduled tasks after pinging hosts imply service reachability probing.
Payloads dropped to \\\\<hostname>\\ADMIN$\\<random>.exe, \\\\<target>\\C$\\Temp\\<exe>; share share$=C:\\Temp created and ACLs widened via icacls to support anonymous/Everyone access.
Lateral Movement
Remote Services: RPC (T1021.001)
Cobalt Strike and subsequent ransomware payloads executed over RPC from the Domain Controller after being copied to admin shares.
Lateral Movement
Remote Services & Service Execution (T1021.001 + T1569.002)
psexec \\\\<target> -accepteula -d -s/-h ... for remote execution, along with remote sc create/sc start to run services DefSvc, UpdateSvc*.
Lateral Movement
Remote Services: Windows Remote Management (T1021.006)
PowerShell Invoke-Command -ComputerName <target> -ScriptBlock {...} used to disable Defender, set exclusions, and start lockers on remote machines.
Lateral Movement
Windows Management Instrumentation (T1047)
wmic /node:<target> process call create "<DEFENDER_SCRIPT_A>" and wmic /node:<target> process call create "C:\\Temp\\<exe> <creds>" to run scripts and lockers remotely.
Lateral Movement
Scheduled Task/Job: Scheduled Task (T1053.005)
Remote scheduled tasks (DefU, DefS, UpdateGU*, UpdateGS*) created on numerous hosts and executed with /S <target> and /Run.
Lateral Movement
Lateral Tool Transfer (T1570)
Locker copied using xcopy "<exe>" "\\\\<target>\\C$\\Temp\\" /Y /I /C /H /R /K and accessible via \\\\<host>\\share$\\<exe> from remote systems.
Lateral Movement
Remote Services: RDP (T1021.001)
RDP access enabled via reg add ...\\Terminal Server /v fDenyTSConnections /d 0 /f and firewall rule enabling “Remote Desktop” group, supporting interactive lateral movement.
Lateral Movement
Ingress Tool Transfer (T1105)
Internal HTTP server on DC offers grand.exe on port 8080, fetched via PowerShell downloadfile(...) to c:\\programdata\\r.exe.
Command and Control
Proxy: Multi‑hop Proxy (T1090.003)
SystemBC (socks.exe) deployed; attempts outbound C2 to 45.86.230[.]112; acts as encrypted SOCKS proxy for C2 tunneling and pivoting.
Command and Control
Ingress Tool Transfer (T1105)
Cobalt Strike payloads and ransomware components transferred via HTTP, SMB (ADMIN$, C$), and NETLOGON share as part of C2 and staging.
Command and Control
Application Layer Protocol: Web Protocols (T1071.001)
Cobalt Strike beacon from rundll32.exe to 91.107.247[.]163 using ports 443 and later 80 (HTTPS/HTTP).
Cobalt Strike uses encrypted HTTPS; SystemBC uses RC4‑encrypted tunnel over SOCKS; both provide encrypted C2 channels.
Exfiltration
Exfiltration Over C2 Channel (T1041)
Ransom note claims “We have exfiltrated all your confidential and business data (including NAS, clouds, etc.)”; details not shown, but implies data exfiltration via C2/remote access tooling (Cobalt Strike, SystemBC, AnyDesk).
Impact (Extortion)
Data Destruction in Extortion (T1654)
Threats of “irreversible wipe of all data and your network” if victim attempts restoration or refuses to negotiate, coupled with timed leak‑site publication.
Impact (Extortion)
Financial Theft / Extortion (T1657)
Classic double‑extortion: demands payment for decryption and to prevent public leak; uses Tox IDs, Session, Tor blog tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion, and X account TheGentlemen25.
Impact
Data Encrypted for Impact (T1486)
Multi‑OS lockers encrypt data (Windows/Linux/ESXi); for large files only 1–9% (depending on --fast/--superfast/--ultrafast) is encrypted with XChaCha20; per‑file footer includes --eph--<base64>--marker--GENTLEMEN\\nGENTLEMEN[...]--.
Impact
Inhibit System Recovery (T1490)
Shadow copies removed via vssadmin delete shadows /all /quiet and wmic shadowcopy delete; $Recycle.Bin removed; logs and prefetch deleted; optional --wipe mode overwrites free space with wipefile.tmp.
Impact
Service Stop (T1489)
Services (including firewall mpssvc and likely AV/backup) stopped and disabled via sc stop <service> and sc config <service> start=disabled.
Impact
Defacement: Internal Defacement (T1491.001)
Desktop background changed to embedded gentlemen.bmp written to %TEMP% and applied via SystemParametersInfoW, signaling compromise to victims.
Login
