A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for affected organizations. Its Windows malware can turn off Microsoft Defender’s real-time protection, add broad exclusions that reduce scanning, stop backup-related services and delete Volume Shadow Copies. These steps weaken defenses and remove common ways to restore files after encryption. The malware also targets more than files. It can clear event logs and other system records that investigators may need to understand what happened. The group uses a double-extortion model: attackers can steal data as well as encrypt it, raising the risk of public exposure even when a victim has backups. The sequence is a reminder that a successful ransomware response depends on protecting both systems and recovery data. Analysts from Acronis’ Threat Research Unit identified these behaviors in its technical analysis of The Gentlemen ransomware and associated tools. The report describes a Go-based ransomware-as-a-service operation that emerged in 2025 and targets Windows, Linux, network-attached storage and BSD systems. Acronis says the group has claimed more than 800 victims, though that figure reflects the group’s claims rather than independently confirmed infections. On Windows, the ransomware attempts to disable Defender’s real-time monitoring and add its process and the C: drive to the exclusion list. That may allow the malware to run with less interference while it prepares to encrypt files. It also stops selected processes and services linked to security tools, databases, virtual machines, email and backup products. Cyber Security News has previously covered how Gentlemen operators disable defenses and backup services during intrusions. The impact is not limited to security software. Stopping database or virtualization services can free files for encryption, while disrupting backup software may prevent routine recovery jobs from running. Hackers Use Gentlemen Ransomware Before encryption, the malware also attempts to remove available Volume Shadow Copies, which Windows can use to restore earlier versions of files. It can clear selected Windows logs, prefetch data and PowerShell command history, reducing the local evidence available to responders. Acronis found that the ransomware can establish persistence through scheduled tasks and Windows startup registry entries. It can also search for connected drives and, when the relevant option is used, network shares. With its spreading feature enabled, it can identify a domain and use PsExec to copy and run the ransomware on other workstations. This behavior connects one compromised machine to broader network risk, a pattern also detailed in Cyber Security News’ coverage of Gentlemen ransomware spreading across networks. The encryption process is designed to move quickly. The report says files under 1 MB are encrypted in full, while larger files may be encrypted in sections. Data leak site (Source – Acronis) The malware uses ChaCha20 for file encryption and elliptic-curve cryptography to protect the file keys. Encrypted files receive an extension that can vary between builds, and the malware leaves a ransom note in affected folders. Acronis also identified a separate tool used to terminate security processes. It drops vulnerable drivers, installs them as services and uses them to stop selected processes at the kernel level. One driver is linked to Safetica ProcessMonitorDriver, associated in the report with CVE-2025-70795; the other is Lenovo’s BootRepair.sys. The technique is known as “bring your own vulnerable driver”: attackers abuse a driver with a weakness to gain actions that ordinary user-level tools may not permit. For more context, see Cyber Security News’ report on vulnerable drivers used against EDR. For defenders, the warning signs include unexpected Defender setting changes, security or backup services stopping, unfamiliar driver installations, log clearing and rapid file changes across multiple systems. Organizations should investigate Organizations should investigate these events together rather than as isolated alerts. Acronis recommends keeping endpoint detection tools active, patching systems and drivers, limiting administrative access, monitoring PowerShell and remote administration tools, and segmenting networks to restrict spread. Backups should be regularly tested and protected with access controls that prevent ordinary compromised systems from deleting or changing them. Keeping critical copies offline or isolated from production can preserve a recovery path if attackers reach administrator accounts. Microsoft likewise advises restoring from verified offline or immutable backups after ransomware incidents. These measures cannot prevent every intrusion, but they can reduce the chance that one compromised device turns into a prolonged outage. Indicators of compromise (IoCs):- CategoryTypeIndicatorWindowsSHA-2561334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436fWindowsSHA-2563c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3WindowsSHA-256586459f1adf018de4586dcd61782839a3ee72d8469944e0f4dd45a6e20598869WindowsSHA-2565206a05eb128ccdef497f7f234cb27678046f6c6b12aa7a072672f2a4694c2b9WindowsSHA-256228fc86acbaa6626051fd189932cb1768254aec5a9539771cee8a567103bbec1WindowsSHA-2569c6f6c0d7127c95aa1360ad6fb0ba5679527a6ea2cc17eb0bc2162dd1e13cd09WindowsSHA-256dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70WindowsSHA-2567eb2fd5e79e79c3f2a95023d617062908c9d8c5aff9fed8361a5a74dc0d1af75WindowsSHA-256403187f08c064f244e101bbc03f1fb5b82af8ebdf4b2be0ba1a70d59ac74b313WindowsSHA-256363a435e517f344056c42f8d46ef73396220f79e780828ad35ec0a68e7525d02WindowsSHA-256cd66fb941e63ad9a72687cafb050ed5b4d8b97b34461168581c4f150d6501523WindowsSHA-2567d90023d535096da99bffcb3370008355435d9f022232870f3c27d29be8be60cWindowsSHA-2567284d45bdbb1e32e3fb1ca6041b448b165795c91a2748de715798238fc8b3bffWindowsSHA-256bd5950d4bd3de1c6d1609b8369b7332ada40c50070a9a3cd8e80ec89b19c48dcWindowsSHA-2564de88220ff6a6dcb137b17d8d3f77ab4bacc39ea4e4d1147f687b021b7a82b8cWindowsSHA-256afc30b1a14f2f29572412ba883782eb3ad3a9e6bf9ff9c38aa48ff35a4ee73faWindowsSHA-256f483faa2b9c9815a0efb08023fe5d243b1b9f7e04b95127c506b6aae824c9d09WindowsSHA-2566a70824fc1777f81c8e8289258ac951e6bac7636db5315b6d7e76c5a58b82b6bEDR killerSHA-256143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676EDR killerSHA-256a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81Vulnerable driverSHA-256a974a9f097bc2e26f285560f1454c70710c88c30c0ae1edfa2977ad862c56716Vulnerable driverSHA-256dfdc8313921c0f594ee1cd41ff7ef73d973c667438c2dfe5c38cafdbba10defbNetworkOnion addresshxxp[://]tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad[.]onion/NetworkSimpleXhxxps[://]smp10[.]simplex[.]im/a#Otp0TGDMNIj_QnXcvh9ABwFsiZEaZY_BovoanW59MXINetworkX accounthxxps[://]x[.]com/TheGentlemen26Threat actorTOX chat IDF8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
——————————————————–
Click Here For The Original Source.
