The Gentlemen: A New Ransomware Group Using Legitimate Tools to Bypass Security

According to Trend Micro, The Gentlemen is a new ransomware group that combines legitimate driver abuse, Group Policy manipulation, and custom anti-security tools to bypass enterprise defences, and has been observed since August 2025. The campaign features techniques such as exploiting legitimate signed drivers, abusing Group Policy Objects for domain-wide compromise, and deploying Allpatch2.exe, an anti-security tool, to disable protections before the ransomware payloads are launched.

The group also employed tools like AnyDesk for covert remote access and used registry modifications to weaken authentication and remote desktop protocols, ensuring footholds during incident response. Trend Micro notes that the operators pursued double extortion, staging sensitive files in hidden directories and exfiltrating them through encrypted channels via WinSCP, while establishing redundant persistence mechanisms.

The campaign impacted multiple industries across at least 17 countries, with Healthcare and insurance sectors highlighted as particularly concerning. The report emphasises advanced capabilities by systematically compromising enterprise environments and using a mix of generic anti-AV utilities and targeted variants.