S9051: The Gentlemen Ransomware

The Gentlemen Ransomware has deleted PowerShell command history for all users by targeting the command history file located in `C:/Users/*/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline/ConsoleHost_History.txt`.[1]

The Gentlemen Ransomware has utilized `esxcli` to execute commands on compromised ESXi systems and VMs.[4]

The Gentlemen Ransomware has modified the ownership and access control settings to ensure it has unrestricted write access to target file paths prior to encryption. The Gentlemen Ransomware has leveraged the `takeown`, `icacls` and `attrib` commands to modify permissions on files and folders.[1][4]

The Gentlemen Ransomware has leveraged Base64-encoded PowerShell scripts.[2]

The Gentlemen Ransomware has leveraged `crontab` to launch the ransomware after a 60-second delay upon reboot using `echo '@reboot sleep 60 && /bin/.vmware-authd ' | crontab - 2>/dev/null`.[4]

The Gentlemen Ransomware has the functionality to delay for a specified number of minutes before file encryption.[1][2][4]

The Gentlemen Ransomware has removed RDP Logs by leveraging the command `del /f /q %SystemRoot%\System32\LogFiles\RDP*\*\*.*`.[1][2][4]

The Gentlemen Ransomware has utilized the domain’s NETLOGON share to distribute the malicious payload to all domain-joined systems.[2]

The Gentlemen Ransomware has leveraged scheduled tasks to execute itself as system.[1][4][3] The Gentlemen Ransomware has also established persistence through the creation of scheduled tasks to include `schtasks /Create /SC ONSTART /TN UpdateSystem /TR “” /RU SYSTEM` and `schtasks /Create /SC ONSTART /TN UpdateUser /TR “”`. The Gentlemen Ransomware has deleted pre-existing scheduled tasks using `schtasks /Delete /TN UpdateSystem /F` and `schtasks /Delete /TN UpdateUser /F`.[1][4]

The Gentlemen Ransomware has utilized Windows APIs to facility network share discovery actions.[4]

The Gentlemen Ransomware has conducted clean shutdowns of running VMs in ESXI environments using `vim-cmd vmsvc/power.off > /dev/null 2>&1`. The Gentlemen Ransomware has also forcibly terminated running VM processes using `esxcli vm process kill --type=force --world-id= > /dev/null 2>&1`.[4]

The Gentlemen Ransomware has used the following command to re-enable SMB1: `Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart`.[4]

The Gentlemen Ransomware has utilized PowerShell to execute commands.[1][2][4][3] The Gentlemen Ransomware has also leveraged PowerShell cmdlets to disable real-time monitoring and set exclusions.[4]

The Gentlemen Ransomware has the ability to modify Group Policy on victim Domain Controllers through a PowerShell script that enables simultaneous ransomware detonation on every computer in domain.[2][4]

The Gentlemen Ransomware has deleted preexisting scheduled tasks and created malicious versions of the same named task to execute automatically at system start to include tasks named `UpdateSystem` and `UpdateUser`.[1] The Gentlemen Ransomware has also leveraged naming conventions that mimic legitimate VMware services.[4]

The Gentlemen Ransomware has modified anti-virus settings to add its own executable to the exclusion list of the endpoint detection solution using the PowerShell command `Add-MpPreference -ExclusionProcess -force`.[1][2][4][3]

The Gentlemen Ransomware has executed service commands using `sc.exe` to modify configurations and allow victim hosts to be visible on the local network.[1]

The Gentlemen Ransomware has utilized RC scripts to establish persistence in ESXi service.[4]

The Gentlemen Ransomware has utilized ESXi administration commands to include `vmkfstools` to modify the compromised system.[4]

The Gentlemen Ransomware has created hidden SMB share folder named “share$” that allowed anonymous access.[1][4]

The Gentlemen Ransomware has gathered Active Directory domain details utilizing the PowerShell cmdlet `Get-ADDomain`.[2]

The Gentlemen Ransomware has executed service commands using `sc.exe` to modify configurations and set the service to “start-auto” to run automatically when the system restarted to include `fdrespub`, `fdPHost`, `SSDPSRV` and `upnphost`.[1][4]

The Gentlemen Ransomware has prevented command logging through the use of `/dev/null 2 &1` that silences output and discards any written data.[4]

The Gentlemen Ransomware has terminated active processes on the victim device. The Gentlemen Ransomware has stopped Windows services using `sc config start=disabled`, `net stop ` and `sc stop `.[1][4] The Gentlemen Ransomware has also disabled running processes using the `taskkill` command for specified processes.[2][4]

The Gentlemen Ransomware has deleted forensic artifacts to include prefetch files, defender diagnostic and support logs using both `del /f /q C:\Windows\Prefetch\*.*` and `del /f /q C:\ProgramData\Microsoft\Windows Defender\Support\*.*`.[1][2][4] The Gentlemen Ransomware has also used a batch script named after itself (`.exe.bat`) to delete The Gentlemen Ransomware and the batch script.[2]

The Gentlemen Ransomware has written registry keys within HKLM and HKCU to gain persistence device wide and to have redundancy. The Gentlemen Ransomware has added registry keys to maintain persistence through `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GupdateS /t REG_SZ /d “” /f` and `reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GupdateU /t REG_SZ /d “” /f`.[1][4]

The Gentlemen Ransomware has copied malware executables, such as PsExec.exe, to the local `C:\Temp` directory.[1][4][3] The Gentlemen Ransomware had also enabled a hidden SMB share pointed at the `C:\Temp` folder to allow anonymous access.[1][4] The Gentlemen Ransomware has also consolidated data in `C:\ProgramData\data\`.[2]

The Gentlemen Ransomware has modified registry keys to allow more permissive access controls to include LSA anonymous access controls.[4]

The Gentlemen Ransomware has the ability to change the system’s desktop wallpaper using a bitmap image file stored as `%TEMP%\gentlemen.bmp`.[1][4]

The Gentlemen Ransomware has used Wevtutil to clear event logs within system, application and security using the commands `wevtutil cl System`, `wevtutil cl Application`, and `wevtutil cl Security`.[1][2][4]

The Gentlemen Ransomware has utilized a wipe feature that writes 64 MB chunks of data to a targeted drive to exhaust all free space and overwrites previously deleted file content, reducing recovery capabilities.[4]

The Gentlemen Ransomware has deleted Volume Shadow Copies through the use of `vssadmin delete shadows /all /quiet` and `wmic shadowcopy delete`.[1][2][4]CitationBradyUnit42_TheGentlemen_July2026 The Gentlemen Ransomware has also inhibited system recovery by stopping backup services, disabling endpoint protection agents and remote access tools.[1][4]

The Gentlemen Ransomware has utilized SOCKS proxy connections for C2.[3]

The Gentlemen Ransomware has utilized Windows Command Shell to execute commands to facilitate lateral movement and other actions.[2][4][3]

The Gentlemen Ransomware has leveraged ephemeral Curve25519 keys with XChaCha20 stream ciphers to encrypt files.[1][4]

The Gentlemen Ransomware has discovered and enumerated valid drives through a PowerShell script.[4] The Gentlemen Ransomware has also scanned for letter drives from A: to Z: using `os.Stat` to determine valid drives.[4]

The Gentlemen Ransomware has modified windows firewall rules to allow for discovery actions using `netsh advfirewall firewall set rule group=”Network Discovery” new enable=Yes` and using the PowerShell command `-Command Get-NetFirewall Rule -DisplayGroup “Network Discovery” | Enable-NetFirewallRule`.[1][4] The Gentlemen Ransomware has also modified firewall rules to allow remote desktop access using the command `netsh firewall set service type remotedesktop mode enable` or `netsh advfirewall firewall set rule group="remote desktop" new enable=Yes`.[2][4] The Gentlemen Ransomware has also deactivated Windows firewall rules using the command ` netsh advfirewall set allprofiles state off`. The Gentlemen Ransomware has disabled the Windows Firewall settings using the PowerShell cmdlet `powershell -Command Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False`.[4]

The Gentlemen Ransomware has excluded the `C:\` volume from scanning to reduce its likelihood of being detected during the encryption process using the PowerShell cmdlet `Add-MpPreference – ExclusionPath C:\ -Force`.[1] The Gentlemen Ransomware has also excluded encryption of specified file names, and file extensions, to include those associated with critical system functionality.[1][4]

The Gentlemen Ransomware has utilized SMB to enable lateral movement and file transfers.[1][4] The Gentlemen Ransomware has leveraged network shares to distribute the ransomware payload to other victim devices throughout the domain.[2]

The Gentlemen Ransomware has obfuscated its code using Go libraries such as `Garble`.[1]

The Gentlemen Ransomware has disabled Microsoft Defender utilizing PowerShell commands to include the cmdlet `Set-MpPreference -DisableRealtimeMonitoring $true -Force`.[1][2][4][3] The Gentlemen Ransomware has also utilized the `TaskKill` command to target specific processes associated with backup software, endpoint detection, and office applications.[2][4]

The Gentlemen Ransomware has enabled Remote Desktop Protocol within victim environments.[2]

The Gentlemen Ransomware has discovered and enumerated network shares using `net use` with corresponding sequential drive letters from A through Z.[1] The Gentlemen Ransomware has also enumerated network shares using Windows APIs to include `WnetOpenEnumW`, `WNetEnumResourceW`, and `WNetCloseEnum`.[4]

The Gentlemen Ransomware has utilized wmic to execute commands on victim devices.[1][4] The Gentlemen Ransomware has also leveraged WMI to enumerate volumes and drives.[1][4]

The Gentlemen Ransomware has enumerated files and directories using WMI and PowerShell commands.[1]