Gentlemen Ransomware Exploits Drivers and Group Policies to Breach Organizations

The Gentlemen ransomware group has emerged as a sophisticated threat actor, targeting manufacturing, construction, healthcare and insurance sectors across 17 countries, according to Trend Micro. Their campaign combines legitimate driver abuse, Group Policy manipulation, and custom anti-AV utilities to bypass enterprise endpoint protections, with a focus on domain-wide compromise via abused Group Policy Objects.

The operators used kernel-level manipulation by deploying legitimate signed drivers, and conducted detailed reconnaissance of endpoint protection mechanisms to tailor their methods, including widening lateral movement using PsExec and weakening security controls through critical registry changes.

They relied on AnyDesk for persistent remote access and exfiltrated data via encrypted channels using WinSCP, while encrypting the domain’s NETLOGON share and targeting FortiGate administrative accounts during network scans. The attack reportedly began in August 2025, and the group has been observed deploying a password-protected payload to evade automated sandbox analysis. Victim distribution spans multiple sectors, with Thailand and the United States cited among key target countries.