Threat Intelligence Report September 9 - September 15 2025

The Gentlemen Ransomware

Red Piranha assesses The Gentlemen as a new, financially motivated ransomware operation active since July 2025. This group demonstrates advanced tradecraft, including the use of vulnerable signed drivers, Group Policy abuse, and double extortion. They have impacted victims across at least 17 countries and multiple industries.

The group appends the extension “.7mtzhh” to encrypted files and drops the ransom note README-GENTLEMEN.txt. Their operations emphasise disabling defences, exfiltrating sensitive data, and then encrypting systems enterprise-wide.

Detailed TTPs

Initial Access

The Gentlemen gain entry through compromised VPN gateways and the use of valid admin credentials. The reliance on FortiGate appliances suggests the exploitation of unpatched vulnerabilities or credential stuffing against exposed services. The use of domain accounts highlights prior credential theft or purchase.

Detections: sudden administrative logons from unusual IPs; anomalous VPN activity.

Execution

Execution is multi-layered: PowerShell scripts disable security tools, while PsExec and Group Policy deliver payloads across the estate. The ransomware binary requires a runtime password to activate its encryption routine, adding an environmental guardrail.

Detections: new domain-wide scheduled tasks; suspicious PowerShell disabling Defender; password-parameterised binary launches.

Persistence

Persistence is maintained via AnyDesk installation, scheduled tasks from GPO, and registry modifications to enable RDP. Attackers may also create hidden admin accounts.

Detections: unexpected AnyDesk installations; new/modified scheduled tasks; registry changes enabling RDP services.

Privilege Escalation

Privilege escalation is not heavily built into the malware itself, but is achieved by tools like PowerRun.exe and the exploitation of signed drivers. These allow SYSTEM-level execution and termination of otherwise protected processes.

Detections: loading of unusual drivers; SYSTEM processes launched by non-system binaries.

Defence Evasion

The hallmark of Gentlemen is impairing defenses. Through All.exe/Allpatch2.exe, they load ThrottleBlood.sys to kill AV/EDR processes at the kernel level. PowerShell disables Microsoft Defender, adds exclusions, removes shadow copies, and clears logs.

Detections: mass process/service termination; Defender exclusion additions; vssadmin execution.

Discovery

The group maps networks using tools like Advanced IP Scanner and Nmap, and enumerates AD accounts, groups, and domain controllers.

Detections: network scanning from unusual hosts; enumeration of Domain Admins; queries to identify PDC.

Lateral Movement

Propagation is domain-wide through the NETLOGON share and PsExec. Group Policy ensures the simultaneous delivery of the ransomware across all machines.

Detections: non-script executables placed in NETLOGON; PsExec launched by non-IT accounts.

Collection & Exfiltration

Files are staged in C:\ProgramData\data before exfiltration via WebDAV or WinSCP. Stolen data is later used for extortion on leak sites.

Detections: anomalous creation of large archives; unusual outbound encrypted transfers.

Impact

Encryption halts business operations. Files receive .7mtzhh extension, ransom note README-GENTLEMEN.txt dropped. Services are stopped (backup, database, AV), and recovery is inhibited by deleting VSS and logs. A batch file then self-deletes the ransomware binary.

Detections: sudden file renaming to .7mtzhh; ransom notes across directories; shadow copy deletions.

MITRE ATT&CK Mapping

IOCs

• File extension: .7mtzhh
• Ransom note: README-GENTLEMEN.txt
• Hashes:
  • c12c4d58541cc4f75ae19b65295a52c559570054 (Ransomware payload)
  • c0979ec20b87084317d1bfa50405f7149c3b5c5f (All.exe – AV killer)
  • df249727c12741ca176d5f1ccba3ce188a546d28 (Allpatch2.exe – updated AV killer)
  • e00293ce0eb534874efd615ae590cf6aa3858ba4 (PowerRun.exe)
• Driver: ThrottleBlood.sys (abused vulnerable driver)
• C2/Leak site: Onion site http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/
• Contact: TOX ID F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E

Detection & Mitigation

Identity & Exposure

• Patch and harden FortiGate VPN appliances; enforce MFA on VPN/RDP/SSO.
• Restrict Domain Controller administrative access.
• Crystal Eye IDM and Crystal Eye SOAR can baseline privileged logins and trigger alerts on anomalies.

Endpoint (Crystal Eye EDR / Crystal Eye XDR)

• Detect and alert on unusual driver loads (ThrottleBlood.sys), mass process kills, or tamper attempts on Defender.
• Monitor for suspicious PowerShell disabling AV or adding blanket exclusions.
• Crystal Eye EDR policies can flag attempts to terminate backup/AV processes or clear logs.

Network (Crystal Eye NGFW / Crystal Eye SOAR)

• Monitor SMB traffic to NETLOGON shares and detect placement of non-script executables.
• Alert on unexpected replication artifacts or GPO script modifications.
• Crystal Eye NGFW can restrict Tor/TOX egress attempts, while Crystal Eye SOAR workflows escalate such events to SOC analysts.

Backup & Recovery

• Maintain immutable/offline backups; test restores routinely.
• Monitor VSS states for deletion events (vssadmin delete shadows).
• Crystal Eye XDR backup monitoring modules can generate early alerts if backup services are stopped.

Hardening & Monitoring

• Enable the Windows vulnerable driver blocklist to prevent BYOVD (ThrottleBlood.sys) abuse.
• Enforce tamper protection in endpoint security.
• Audit DCs for new/modified GPOs and logon scripts.
• Crystal Eye XDR’s configuration monitoring can baseline scheduled tasks and flag unauthorised persistence mechanisms.

Ransomware Victims Worldwide

The United States continues to dominate the global ransomware victim landscape, accounting for 54.42% of reported cases this week. This overwhelming share highlights the nation’s persistent vulnerability, driven by its large digital economy, diverse industry targets, and lucrative victim profiles.

Canada (4.76%) and Australia (4.08%) represent the next highest concentrations, reaffirming their position as prime targets in the Anglosphere. Both countries have critical industries—energy, healthcare, and business services—that attract threat actors due to their economic importance and frequent reliance on outsourced IT.

The United Kingdom (3.4%) and France (3.4%) also remain in the top tier of impacted nations, alongside Germany (2.72%) and Spain (2.72%), demonstrating ransomware’s continued impact across Western Europe. These countries often face double extortion campaigns, where stolen data is weaponised to pressure negotiations.

A middle cluster of victimisation includes Argentina (2.04%), Colombia (2.04%), and the United Arab Emirates (2.04%), reflecting ransomware operators’ spread into Latin America and the Middle East. Poland, India, Indonesia, Thailand, and Venezuela each logged 1.36%, signaling a broadening distribution into emerging economies.

Lower-level but still significant incidents were recorded in Brazil, Taiwan, Switzerland, Nigeria, Russia, Panama, Kuwait, El Salvador, Morocco, Sweden, Oman, Japan, South Korea, and Namibia, each registering 0.68% of cases. These isolated but recurring entries underscore ransomware’s global reach, affecting both advanced and developing economies across multiple continents.