The Gentlemen

The malware uses WMI via wmic.exe to create remote processes.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

Before attempting to run the payload on a remote system, the malware executes the following PowerShell command on the remote target to weaken local defenses and make payload execution more reliable.

To relaunch itself as SYSTEM, it issues the following sequence of commands... It first deletes any existing task named gentlemen_system... creates a new one-time task... and finally triggers that task.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

The commands copy the malware executable into C:\Temp, creates a hidden Server Message Block (SMB) share named share$ pointing to that directory, and modifies registry settings to allow anonymous access.

The malware executes the following command sequence to create three Windows services on the target host.

The GupdateS value under HKEY_LOCAL_MACHINE (HKLM) provides device-wide persistence that allows the malware to run at startup for all users, while the GupdateU value under HKEY_CURRENT_USER (HKCU) provides user-scoped persistence within the current profile.

When the -- system argument is provided (either directly or via the -- full argument), the malware creates a scheduled task to re-execute itself as SYSTEM.

The scheduled task DefU is set to run the defense evasion blob, UpdateGU executes the payload from the infected host’s SMB share, and UpdateGU2 runs the pre-staged copy from the target’s local C:\Temp directory.

Their research shows the ransomware follows a very deliberate sequence, starting with password validation and privilege escalation, then moving into defense evasion, encryption, and finally network-wide spreading.

the custom ransomware locker ... as well as the GPO-based spread mechanism and the locker’s 'spread' module.

The malware executes the following command sequence to create three Windows services on the target host.

The GupdateS value under HKEY_LOCAL_MACHINE (HKLM) provides device-wide persistence that allows the malware to run at startup for all users, while the GupdateU value under HKEY_CURRENT_USER (HKCU) provides user-scoped persistence within the current profile.

When the -- system argument is provided... the malware creates a scheduled task to re-execute itself as SYSTEM.

To further impede recovery efforts, the malware deletes all Volume Shadow Copies using both vssadmin and wmic... It then clears the System, Application, and Security event logs using wevtutil to remove key audit trails.

Before touching a single file, the ransomware works to disable Microsoft Defender, wipe forensic logs... It also clears command history

Additionally, the malware manually deletes PowerShell command history across all user profiles... If the -- keep flag is not provided, the malware attempts to remove its executable from disk after completing encryption.

The commands copy the malware executable into C:\Temp, creates a hidden Server Message Block (SMB) share named share$ pointing to that directory, and modifies registry settings to allow anonymous access.

the custom ransomware locker ... as well as the GPO-based spread mechanism and the locker’s 'spread' module.

After dropping PsExec, the malware attempts to enumerate and discover remote systems on the network, including workstations, servers, and domain controllers.

The -- spread argument accepts either explicit credentials in domain/user:password format for authenticated lateral movement, or an empty string to reuse the current session’s authentication token.

the malware pulls in a legitimate system tool called PsExec... and starts scanning the network for reachable machines, including regular workstations, servers, and domain controllers.

The malware stops a list of running processes using the command: The table below summarizes the different categories and processes being targeted.

The -- spread argument accepts either explicit credentials in domain/user:password format for authenticated lateral movement, or an empty string to reuse the current session’s authentication token.

To enumerate all available volumes on the system, the malware executes the following PowerShell command sequence.

When the command-line argument -- shares is provided, the malware initiates network share discovery and enumeration. It begins by probing all drive letters A through Z to identify mapped network drives.

the custom ransomware locker, the RaaS panel and builder ... as well as the GPO-based spread mechanism and the locker’s 'spread' module.

The commands copy the malware executable into C:\Temp, creates a hidden Server Message Block (SMB) share named share$ pointing to that directory, and modifies registry settings to allow anonymous access.

Once activated, the infected machine turns itself into a distribution hub by copying its own binary into a folder and publishing it over a hidden network share configured for anonymous access.

The malware binary carries an embedded copy of PsExec and drops it to C:\Temp\psexec.exe on the infected device. If the embedded PsExec payload cannot be extracted successfully, the malware falls back to downloading PsExec directly from Microsoft’s Sysinternals Live service.

The operators behind the ransomware use double extortion tactics, encrypting data while also exfiltrating sensitive information to pressure victims through the threat of public release if the ransom is not paid.

Combined with double extortion tactics, where stolen data is used as leverage alongside encryption, the threat represents a serious risk for organizations of nearly any size or sector.

delete Volume Shadow Copies twice over using two separate commands for reliability. It also clears command history and deletes backup and recovery tools to make restoring systems without paying much harder.

Finally, once the environment is prepared and critical data is in their control, they deploy their custom ransomware 'locker,' which is designed to spread quickly across the network... and encrypt systems in a coordinated manner.

In addition to terminating processes, the malware disables and stops a list of Windows services.

To further impede recovery efforts, the malware deletes all Volume Shadow Copies using both vssadmin and wmic.

If the -- wipe argument is provided, The Gentlemen ransomware performs an additional post-encryption routine to eliminate recoverable artifacts from disk.

The Gentlemen ransomware group, tracked by Microsoft as Storm-2697, claimed responsibility for the attack and added Mackay Sugar to its Tor-based data leak site on June 15. At this time, no data has been leaked yet, which usually means negotiations are still ongoing.

Before starting file encryption, the malware executes a sequence of commands to disable defensive controls and remove potential forensic artifacts.

The PowerShell commands disable Microsoft Defender real-time monitoring to remove active protection on the infected device. The malware then adds its own executable to the Defender exclusion list to avoid detection. Finally, it excludes the entire C:\ volume from scanning.