The Gentlemen ransomware group has emerged as a sophisticated threat actor targeting multiple industries across 17 countries, with a focus on the Asia-Pacific region. Their campaign demonstrates advanced capabilities, including the use of custom tools to bypass enterprise endpoint protections, exploitation of legitimate drivers, Group Policy manipulation, and encrypted data exfiltration. The group's tactics involve thorough reconnaissance, adaptive defense evasion techniques, and systematic compromise of enterprise environments. They have shown the ability to tailor their approach based on the specific security solutions encountered, highlighting a significant evolution in ransomware operations. The attackers leveraged various tools and techniques for lateral movement, persistence, and ransomware deployment, including the abuse of privileged domain accounts and Group Policy Objects.
Earth Lamia is an advanced persistent threat (APT) actor active since 2023, targeting organizations primarily in Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, notably SQL injection, to gain initial access. They have developed custom malware tools such as the PULSEPACK backdoor and BypassBoss for privilege escalation. Their targeting has evolved from financial services to logistics, online retail, IT companies, universities, and government organizations. Techniques used include DLL sideloading, leveraging legitimate binaries, and modular backdoor deployment. The group's campaigns are linked to other reported activities, indicating a sophisticated and evolving threat actor.
