THE Gentlemen ransomware operates as a ransomware-as-a-service under the GOLD SHERWOOD banner, with affiliates handling data theft, defence disruption and rapid encryption. Sophos Counter Threat Unit confirms the operation, noting a repeatable affiliate playbook that combines opportunistic initial access, rapid privilege escalation, use of legitimate remote access mechanisms, tool staging in trusted paths, targeted data exfiltration, aggressive defence evasion, backup disruption and ransomware deployment. In many cases the group completes the operation in under 24 hours.
Initial access typically occurs at the network edge, with stolen VPN credentials and exposed firewall management interfaces used to enter victim networks. In one February incident, attackers logged into a Fortinet SSL VPN without MFA, enabling entry; linked activity also points to a FortiGate-related flaw, CVE-2024-55591. Once inside, they move laterally via RDP, reuse domain credentials and repeatedly reconnect to maintain access.
The infection chain features tools staged in trusted folders such as C:\PerfLogs, followed by network mapping with Advanced IP Scanner and SoftPerfect Network Scanner, credential dumping with Mimikatz, and privilege escalation by adding rogue admin accounts or resetting high-value passwords. A Cloudflared tunnel was observed as a persistence mechanism, and there are other cases of re-enabling RDP through registry or firewall changes.
Defence evasion centres on a custom EDR killer suite, GentleKiller, and the use of BYOVD tactics to target security products. Data exfiltration employs Rclone, Restic and MinIO Client, with a double-extortion model where data theft precedes encryption. Median dwell time is about two days, with the fastest incidents under 24 hours.
Practical responses emphasise MFA for VPNs, timely patching of internet-facing devices, monitoring staging paths like C:\PerfLogs, watching for new admin members, and guarding backups and exfiltration tools.