The Gentlemen Ransomware Group Strikes with Rapid, EDR-Evading Attacks

The Gentlemen ransomware operation, also tracked as GOLD SHERIFF, has demonstrated a highly efficient and rapid attack playbook that allows affiliates to achieve full network encryption in less than a day. This ransomware-as-a-service (RaaS) model enables various threat actors to leverage the group's tools and tactics against targeted organizations. The operation employs a double-extortion strategy, first exfiltrating sensitive data before encrypting systems, thereby increasing pressure on victims to comply with ransom demands.

Analysis by Sophos of 15 incidents revealed a consistent methodology. Initial access is typically gained through compromised internet-facing infrastructure, such as exposed firewall management interfaces, unpatched devices, or stolen VPN credentials. A notable vector identified was the exploitation of a Fortinet SSL VPN vulnerability, particularly in instances where multi-factor authentication was not enforced, highlighting the continued risk posed by such flaws.

Once inside the network, attackers utilize legitimate credentials and Remote Desktop Protocol (RDP) for lateral movement. They strategically place their toolkit in overlooked Windows directories and proceed to map critical assets, including data stores and backup infrastructure. To solidify their control, they often modify administrator passwords, create new privileged accounts, and enable RDP access, sometimes even configuring firewall rules to ensure persistent external access.

The group's playbook includes a deliberate disabling of security tools, a common tactic among sophisticated ransomware gangs. Attackers employ custom utilities, publicly available tools, and even vulnerable drivers to terminate antivirus and endpoint detection and response (EDR) processes. They also actively weaken Windows Defender by configuring broad scan exclusions or altering policy settings, aiming to create an environment free from detection.

In parallel with disabling security software, the Gentlemen operation systematically targets backup and recovery services. This critical step aims to eliminate or severely hinder a victim's ability to restore systems and data, thereby maximizing the impact of the ransomware deployment. In some observed cases, attackers also meticulously cleared event logs to obscure their tracks and complicate forensic investigations.

Before initiating encryption, the attackers exfiltrate data using legitimate transfer tools, often filtering for newer data to reduce the volume and potentially evade detection. This flexibility in tool selection, similar to tactics seen in other ransomware campaigns targeting remote infrastructure, allows them to adapt to changing network conditions. The median time from initial compromise to ransomware deployment was approximately two days, with some instances occurring in under 24 hours.

The ransomware is deployed locally, via network shares, or across the domain using remote execution methods. While the analyzed cases primarily involved Windows environments, related variants are known to target Linux and ESXi systems. The rapid pace of these attacks underscores the importance of robust preventative measures and swift detection capabilities.

To mitigate the risks associated with the Gentlemen ransomware, organizations are advised to patch internet-facing devices, enforce MFA for all remote access, restrict RDP exposure, and closely monitor for unusual activity. Implementing strong backup strategies, including air-gapped or immutable backups, and regularly testing recovery plans are crucial defenses against this fast-moving threat.