The Gentlemen are knocking: сustom backdoors and evolving tactics

What Happened

A criminal group called The Gentlemen is running a ransomware-as-a-service operation, where they rent out their ransomware to other criminals who then attack companies. They break into organizations by exploiting weaknesses in internet-facing devices like VPNs and firewalls, often using stolen passwords. Before locking up files, they plant a hidden backdoor program that lets them remotely control the compromised computers and move through the network. They also disable antivirus software using a technique that installs vulnerable driver files. The ransomware itself spreads automatically across an organization's network by abusing Windows group policy settings, encrypting files on all computers at once. A newer version of their ransomware is being developed, suggesting the group is growing and adapting. Organizations should focus on patching vulnerabilities, strengthening login security, and monitoring for unusual activity on their networks.

Key Takeaways

• The Gentlemen ransomware group operates a RaaS model and has rapidly become a top-10 ransomware actor by victim count in the first half of 2026, targeting critical infrastructure and large corporations globally.
• A custom Go-based backdoor was deployed prior to ransomware execution, establishing persistent C2 via the Yamux library on TCP port 9443, supporting remote command execution and SOCKS proxying for internal pivoting.
• The group uses BYOVD (Bring Your Own Vulnerable Driver) to disable security software, leveraging at least seven different vulnerable drivers including ProcessMonitorDriver.sys, biontdrv.sys, and havoc.sys.
• A new C-based ransomware variant is in development, switching from Curve25519+XChaCha20 to AES256-GCM+RSA encryption and shifting communication from Tox Messenger to email.
• Lateral movement is achieved through GPO deployment via a generated deploy_gpo.ps1 script that copies the ransomware to NETLOGON, creates a fake update policy disabling Defender, and forces group policy refresh across all domain computers.

Affected Systems

• Windows endpoints and servers (amd64 and 386 architectures)
• Windows Domain Controllers
• Hyper-V virtual machines
• Hardware VPNs and firewalls exposed to the internet
• Linux ESXi servers (C-based variant mentioned but not detailed)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Exploit vulnerabilities in internet-exposed VPNs/firewalls or use stolen/weak credentials, potentially sourced from initial access brokers
2. Reconnaissance: Deploy SharpADWS, NetScan, Advanced IP Scanner, and netsh to enumerate Active Directory, scan network services, and capture network traffic for credentials
3. Backdoor Deployment: Deploy custom Go-based backdoor (sihost.exe) that connects to C2 at 81.177.215.15:9443, collects system info, executes commands, and establishes SOCKS proxy for pivoting
4. Defense Evasion: Use BYOVD technique with vulnerable drivers, Windows Kernel Explorer, OpenArk64, and registry modifications to disable security software and Windows Defender
5. Lateral Movement: Spread ransomware via GPO deployment (deploy_gpo.ps1 copying to NETLOGON and creating malicious ScheduledTasks.xml) or PsExec with domain computer enumeration via RSAT
6. Impact: Stop Hyper-V VMs and processes, encrypt files using Curve25519+XChaCha20 (Go) or AES256-GCM+RSA (C variant), drop ransom notes, delete shadow copies and event logs

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not include detection rules. IOCs including file hashes, IP addresses, and command-line fragments are provided in the text. Additional IOCs are available to Kaspersky Intelligence Reporting Service customers via [email protected].

Detection Engineering Assessment

Required Log Sources

• Windows Security Event Log (Event IDs 4624, 4688, 4698, 4702, 5140, 5145)
• Windows System Event Log
• Windows Application Event Log
• PowerShell Script Block Logging (Event ID 4104)
• Windows Defender Event Log
• Sysmon Event Logs (Event IDs 1, 3, 7, 11, 12, 13, 22)
• DNS resolution logs
• Network firewall/IDS logs for C2 traffic
• Active Directory Group Policy change logs

Hunting Hypotheses

Control Gaps

• BYOVD attacks exploit vulnerable signed drivers that are legitimately loaded by the kernel, bypassing driver signature enforcement and potentially blinding EDR before detection logic can fire.
• GPO-based lateral movement abuses legitimate Windows infrastructure (SYSVOL, NETLOGON, Group Policy) which may not be monitored for malicious content by standard endpoint controls.
• The Go backdoor uses standard cmd.exe for command execution and TCP for C2, which may not trigger network IDS signatures without specific port or IP-based rules.
• Volume shadow copy deletion and event log clearing occur rapidly during the impact phase, potentially destroying forensic evidence before analysts can respond.
• If initial access is obtained through an IAB, the time gap between initial compromise and ransomware deployment may exceed typical detection windows, allowing attackers to establish persistence unnoticed.

Key Behavioral Indicators

• Process ancestry: sihost.exe spawning cmd.exe with /c argument, especially when sihost.exe is not in a standard system path
• Registry pattern: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender with DisableAntiSpyware set to dword:00000001
• Registry pattern: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with value name 'GupdateS'
• Scheduled task named 'UpdateUser' with ONSTART trigger or 'TaskSystem' with DAILY trigger at 20:00
• File creation of deploy_gpo.ps1 in %temp% directory
• File creation of ScheduledTasks.xml in SYSVOL directory
• File creation of README-GENTLEMEN.txt or !-READ-ME—-GEN-TLE-MEN-!.txt in multiple directories
• Sequential execution of vssadmin.exe delete shadows, wmic.exe shadowcopy delete, and wevtutil.exe cl commands
• Driver loading events for processmonitordriver.sys, wamsdk.sys, gamedriverx64.sys, biontdrv.sys, inpoutx64.sys, wsftprm.sys, or havoc.sys from non-standard paths
• PowerShell execution of Set-MpPreference -DisableRealtimeMonitoring $true followed by Add-MpPreference -ExclusionPath 'C:'
• netsh trace start capture=yes executed from cmd.exe with output redirected to ADMIN$ share

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether internet-exposed VPNs and firewalls are running current firmware versions. Consider implementing network-level MFA for all remote access devices.
• Consider monitoring SYSVOL and NETLOGON shares on domain controllers for unauthorized file creation, particularly .ps1 and .xml files, if your tooling provides file integrity monitoring on these paths.
• Evaluate whether Windows Defender tamper protection is enabled across all endpoints, which would prevent registry-based disabling of real-time protection features.
• Consider implementing Microsoft's vulnerable driver blocklist if not already deployed, to mitigate BYOVD attacks across the fleet.
• If supported by your environment, consider restricting PsExec execution and SMB admin share access (ADMIN$, C$) to specific administrative accounts and workstations.

User Protection

• Consider enforcing MFA on all remote access points including VPNs, RDP, and web-based administration portals, particularly for accounts with elevated privileges.
• Evaluate whether endpoint detection tools are configured to alert on Windows Defender exclusion path additions, especially broad exclusions like 'C:'.
• Consider verifying that Hyper-V VMs have backup copies stored on separate infrastructure that would not be affected by host-level encryption.
• If applicable, consider deploying application control (e.g., WDAC, AppLocker) to restrict execution of unsigned binaries from %temp% and user-writable directories.

Security Awareness

• Consider incorporating awareness training on credential hygiene, emphasizing the risk of reused or weak passwords on internet-exposed services.
• If your organization uses Tox Messenger or similar encrypted communication tools, consider awareness training for IT staff on how ransomware groups abuse these platforms for victim communication.
• Consider briefing IT operations teams on the indicators of GPO-based ransomware deployment so they can recognize suspicious Group Policy changes during incident response.

MITRE ATT&CK Mapping

Additional IOCs

• File Hashes:
  • 3B46A729DB7AE6AF8B19711C9452194D (MD5) - Go ransomware binary: locker_eryoo5_windows_amd64
  • 02944C8A5535CDB5B2CBB893DB2D5ACF (MD5) - Go ransomware binary: locker_lqy8xb_windows_amd64.exe
  • 10CA9A4040001560D053B7E7885C1B95 (MD5) - Go ransomware binary: locker_28f3cl_windows_386.exe
  • 3C471EBC947CDF32240A90FFADF49B13 (MD5) - Go ransomware binary: locker_aga19g_windows_amd64.exe
  • 4BE8BB62F0EBBCF4CE52C35AB6F794F5 (MD5) - Go ransomware binary: locker_wh54td_windows_386.exe
  • 53C616677BC7E2A0A03127F19166D007 (MD5) - Go ransomware binary: locker_p663zs_windows_amd64.exe
  • 5F0B2C6D9F442754258BF4DD841C8341 (MD5) - Go ransomware binary: locker_t1zged_windows_amd64.exe
  • 608FAF58353B65C45EF9833358AC3787 (MD5) - Go ransomware binary: locker_u90lyt_windows_amd64.exe
  • 846DC77C1246DB20D976346E0E359502 (MD5) - Go ransomware binary: locker_p663zs_windows_386.exe
  • ADAC9984B3CC43D66A0D33079BBEC299 (MD5) - Go ransomware binary: UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b
  • AE0E536766788478263BF448A9381641 (MD5) - Go ransomware binary: cosmo.exe
  • B3E418D30312C1B2C58A791286868F42 (MD5) - Go ransomware binary: system_386.exe
  • C2764744DCB4B0E1DB79CA1E8BF65368 (MD5) - Go ransomware binary: getlwd.exe
  • D12A5B36DD00586CC374A1CAE43EFED4 (MD5) - Go ransomware binary: locker_c65ffp_windows_amd64.exe
  • D2F72897E8986303D5567EB2384932B8 (MD5) - Go ransomware binary: UcAaJ_o_1j9srso9a14071ps4p7s3f81s1b (duplicate filename, different hash)
  • DE1522F9219497632F30F8A6E72F26B6 (MD5) - Go ransomware binary: locker_c7ekh7_windows_amd64.exe
  • FDAE2BEB813778B4540A997706862096 (MD5) - Go ransomware binary: AIR.exe
  • 5761BD63DA03686FC480245DA7BD1E9F (MD5) - Vulnerable driver: processmonitordriver.sys (Safetica DLP and EDR driver) used in BYOVD attacks
  • B6B51508AD6F462C45FE102C85D246C8 (MD5) - Vulnerable driver: wamsdk.sys (WatchDog anti-malware driver) used in BYOVD attacks
  • 8F0577D28C4FF5F71B149F444BFABA8E (MD5) - Vulnerable driver: gamedriverx64.sys (Fedeen/Hotta studio anti-cheat driver) used in BYOVD attacks
  • 525EF6014F0EF20E44FE47C1D9980B69 (MD5) - Vulnerable driver: biontdrv_wink.sys (Paragon partition manager driver) used in BYOVD attacks
  • 407B6A136BBAA7172EB44EF9D08BB58A (MD5) - Vulnerable driver: biontdrv_winbs.sys (Paragon partition manager driver) used in BYOVD attacks
  • 9321A61A25C7961D9F36852ECAA86F55 (MD5) - Vulnerable driver: inpoutx64.sys (legacy RGB lighting driver) used in BYOVD attacks
  • 73F0A8C3EA794A04E80C32038249F044 (MD5) - Vulnerable driver: wsddprm.sys (Topaz anti-fraud software driver) used in BYOVD attacks
  • EEF8A950952696B018AA9C6DA2F5D7AD (MD5) - Vulnerable driver: havoc.sys (Huawei audio driver) used in BYOVD attacks
  • EDB1C480295250DD1A38F3AA1357DEAE (MD5) - Scanning tool: netscan64.exe used for network reconnaissance
  • 5537C708EDB9A2C21F88E34E8A0F1744 (MD5) - Scanning tool: Advanced_IP_Scanner_2.5.4594.1.exe used for network reconnaissance
• Registry Keys:
  • HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection - Registry subkey where DisableBehaviorMonitoring, DisableOnAccessProtection, and DisableScanOnRealtimeEnable are set to 1 to disable Windows Defender real-time protection.
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - Registry Run key where the ransomware adds a value named 'GupdateS' pointing to the ransomware path for persistence on startup.
• File Paths:
  • \\Netlogon\ - Network share where the ransomware copies itself for distribution to all domain computers via GPO deployment.
  • C:\Windows\sysvol\domain\scripts\ - SYSVOL directory path where the malicious ScheduledTasks.xml is placed for GPO-based ransomware deployment.
  • C:\Temp - Directory where PsExec.exe is downloaded when the --spread parameter is used and PsExec is absent on the target system.
• Command Lines:
  • Purpose: Capture network traffic for reconnaissance using netsh trace, saving to a remote admin share with a random filename | Tools: cmd.exe, netsh | Stage: Reconnaissance | cmd.exe /Q /c netsh trace start capture=yes
  • Purpose: Disable Windows Defender real-time monitoring and controlled folder access, and add exclusions | Tools: powershell.exe | Stage: Defense Evasion | Set-MpPreference -DisableRealtimeMonitoring $true -Force
  • Purpose: Create a scheduled task named 'UpdateUser' to run the ransomware on system startup for persistence | Tools: schtasks.exe | Stage: Persistence | schtasks.exe /Create /SC ONSTART /TN "UpdateUser" /TR
  • Purpose: Add a registry Run key value named 'GupdateS' for ransomware persistence on startup | Tools: reg.exe | Stage: Persistence | reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GupdateS"
  • Purpose: Delete volume shadow copies to inhibit system recovery | Tools: vssadmin.exe | Stage: Impact | vssadmin.exe delete shadows /all /quiet
  • Purpose: Clear Windows event logs to cover tracks | Tools: wevtutil.exe | Stage: Defense Evasion | wevtutil.exe cl System
  • Purpose: Modify file ACL to grant full control to Everyone before encryption | Tools: takeown.exe, icacls.exe | Stage: Impact | icacls.exe <target_file> /grant *S-1-1-0:F
  • Purpose: Create a scheduled task named 'TaskSystem' to execute with SYSTEM privileges in the C-based ransomware variant | Tools: schtasks.exe | Stage: Privilege Escalation | schtasks /create /sc DAILY /tn "TaskSystem" /tr
  • Purpose: Stop Hyper-V virtual machines before encrypting virtual disk files | Tools: powershell.exe | Stage: Impact | Get-VM | Stop-VM -Force -TurnOff
  • Purpose: Download PsExec.exe from Sysinternals when not present on target system for lateral movement | Tools: powershell.exe | Stage: Lateral Movement | powershell.exe -Command "Invoke-WebRequest -Uri
• Other:
  • CbdU8EgF - Hardcoded password required by the Go ransomware variant to execute. Acts as an anti-sandbox/anti-analysis mechanism. The binary terminates if the password is incorrect or absent.
  • HvzC6Dq/siFthWSgE5ozZyQDu9cyxIoxb3NuRHI6pDM= - Base64-encoded Curve25519 attacker public key embedded in the Go ransomware binary. Used to compute a shared secret for file encryption.
  • UpdateUser - Scheduled task name created by the Go ransomware variant for persistence, configured to run on startup.
  • TaskSystem - Scheduled task name created by the C-based ransomware variant to execute with SYSTEM privileges, configured as a daily task at 20:00.
  • GupdateS - Registry value name added to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run by the Go ransomware for startup persistence.