The Gentlemen RaaS TTPs Analysis & Defense Guide: Ransomware, Lateral Movement & Backdoor

Vulnerability Overview The Gentlemen is an organization operating under the Ransomware-as-a-Service (RaaS) model, active since early 2026. The group utilizes various vulnerabilities and techniques for attacks, including initial infection vectors, reconnaissance, lateral movement, disabling security products, deploying backdoors, and executing ransomware. Impact Scope Targets: Large enterprises and critical infrastructure. Activity: Since February 2026, The Gentlemen's activity has increased significantly, making them one of the top ten ransomware actors in the Data Leak 5 (DL5) incidents in the first half of 2026. Techniques: Use of custom backdoors, Go-written ransomware, PowerShell scripts, PsExec, and other tools for attacks. Remediation Strategies 1. Initial Infection Vector: - Avoid using vulnerable online services and weak login credentials. - Use hardware VPNs and firewalls to protect devices exposed to the internet. 2. Reconnaissance: - Use tools such as SharpADWS, NetScan, and Advanced IP Scanner for internal reconnaissance. - Use Microsoft's tool to capture network packets. 3. Lateral Movement: - Distribute ransomware executables via the NETLOGON share. - Use PowerShell script and PsExec for lateral movement. 4. Disabling Security Products: - Install vulnerable drivers using the Bring Your Own Vulnerable Driver (BYOVD) technique. - Use Windows Kernel Explorer and OpenArk64 to disable security software. - Modify Windows registry settings to disable Windows Defender real-time monitoring. 5. Backdoor Deployment: - Use Go-written backdoors for remote command execution. - Use the Yamux library to establish persistent bidirectional TCP connections. 6. Ransomware Execution: - Use Go-written ransomware for file encryption. - Use the parameter to prevent execution in sandbox or automated environments. 7. System Execution Prevention: - Use PowerShell script for lateral movement. - Use PsExec for lateral movement. 8. Pre-encryption Activities: - Stop Hyper-V virtual machines. - Terminate specific processes and services. - Create scheduled task to run ransomware at startup. 9. Encryption Process: - Use hybrid encryption algorithms (Curve25519 and XChaCha20) for file encryption. - Change file access permissions to "Everyone". POC Code ```powershell Go-based ransomware execution schtasks.exe /Delete /TN "UpdateUser" /F schtasks.exe /Create /SC ONSTART /TN "UpdateUser" /TR "" /F reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "UpdateUser" /t REG_SZ

Goal Reached Thanks to every supporter — we hit 100%!

The Gentlemen RaaS TTPs Analysis & Defense Guide: Ransomware, Lateral Movement & Backdoor