‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You Out

The Gentlemen ransomware group employs a Ransomware-as-a-Service model with dual-extortion, exfiltrating sensitive data before encrypting systems across Windows, Linux, and ESXi environments. Their attack lifecycle emphasizes preparation, including privilege escalation through legitimate administrative tools like PowerRun.exe, establishing persistence via registry modifications, scheduled tasks, and autostart mechanisms. They disable security tools, delete logs, and terminate database and backup services to maximize impact. Encryption uses XChaCha20 and Curve25519 algorithms. The group mainly targets medium-to-large organizations in the Asia-Pacific region, with activity increasing by 2,100% over typical levels. Ransom notes impose approximately 10-day deadlines, threatening to leak stolen data if demands are unmet.

The group’s dual-extortion approach threatens confidentiality by exfiltrating sensitive data prior to encryption, and availability by encrypting systems and disrupting backup and database services. Disabling security tools and deleting logs complicate detection and incident response. The use of strong encryption algorithms and persistence mechanisms increases the difficulty of recovery without paying ransom. The threat is significant for medium-to-large organizations in the Asia-Pacific region due to targeted focus and increased activity.

No official patch or fix applies as this is a threat actor profile rather than a software vulnerability. Organizations should focus on detection and prevention measures tailored to ransomware and dual-extortion tactics, such as monitoring for privilege escalation tools, persistence mechanisms, and unusual administrative activity. Incident response plans should consider the threat of data exfiltration and rapid encryption. The vendor advisory does not specify any 'no action required' or 'already mitigated' status. Patch status is not applicable.