AttackIQ Releases Two Emulations of The Gentlemen Ransomware TTPs
Summary
AttackIQ released two assessments emulating The Gentlemen ransomware’s reported TTPs, including persistence, Defender evasion, Active Directory discovery, SMB lateral movement and file encryption, to help customers test security controls.
Key points
- AttackIQ released two assessments to help customers validate detection, prevention and response against behaviors associated with The Gentlemen ransomware.
- The emulations are based on behaviors reported by Trend Micro, Cybereason, BlackPoint Cyber and Check Point.
- The article describes The Gentlemen as active since July 2025 and using double extortion; it reports targeting Windows, Linux and ESXi environments.
- The Windows emulation includes persistence through scheduled tasks, registry Run keys and services, plus Defender tampering and Active Directory discovery.
- Lateral-movement scenarios include creating network shares, weakening anonymous-access controls, using WMI and enabling SMBv1.
- Impact scenarios model shadow-copy deletion, event-log clearing and file encryption; the article says the group has used XChaCha20 and Curve25519.
Article Details
- Event Type
- AttackIQ released two emulations of The Gentlemen ransomware group's reported tactics, techniques, and procedures.
- Impact
- The Gentlemen is reported to use double extortion, combining file encryption and data exfiltration with a dedicated leak site to pressure victims. The article says its activity has particularly affected manufacturing, construction, healthcare, and insurance organizations in Asia-Pacific and South America. AttackIQ's emulations are intended to help customers test security controls and response readiness; no specific victim count or incident-level impact is reported.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235 | SHA-256 of a The Gentlemen ransomware sample identified as malicious and used in the AttackIQ emulation. |
| SHA256 | 4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71 | SHA-256 of the PowerRun sample listed in the article's malware samples used in the assessment. |
| SHA256 | 7a311b584497e8133cd85950fec6132904dd5b02388a9feed3f5e057fb891d09 | SHA-256 of the KILLAV all.exe sample listed in the article's malware samples used in the assessment. |
MITRE ATT&CK
T1018 · Remote System DiscoveryGet-ADComputer is used to enumerate domain-joined computers as potential lateral-movement targets.T1021 · Remote ServicesThe emulation creates a network share with full access to support movement across the network.T1047 · Windows Management InstrumentationWMI is used to create and execute a process on a remote system.T1049 · System Network Connections DiscoveryThe emulation enumerates network resources from the local computer.T1053.005 · Scheduled TaskA scheduled task is created to execute at system startup for persistence.T1059.001 · PowerShellPowerShell is used for administrative commands, discovery, and security-setting changes.T1070.001 · Clear Windows Event LogsThe emulation clears Windows event logs to remove traces.T1082 · System Information DiscoveryThe ransomware emulation gathers system and volume information to profile the host and identify storage.T1105 · Ingress Tool TransferThe emulation downloads the ransomware sample and copies payload files to target locations.T1482 · Domain Trust DiscoveryThe emulation queries Active Directory domain information using Get-ADDomain.T1486 · Data Encrypted for ImpactThe ransomware encrypts files in place using XChaCha20 and Curve25519 for key protection.T1490 · Inhibit System RecoveryVolume Shadow Copies are deleted to inhibit system recovery.T1543.003 · Windows ServiceThe emulation uses sc.exe to create a service for persistence.T1547.001 · Registry Run Keys / Startup FolderA Registry Run key is added for user-level persistence.T1562.001 · Disable or Modify ToolsThe reported activity disables Microsoft Defender real-time monitoring and adds exclusions.
Threat Actors
Malware
Vendors
Products
AttackIQ Adversarial Exposure Validation (AEV) PlatformBy using this new emulation in the AttackIQ Adversarial Exposure Validation (AEV) Platform, security teams will be able to:ESXiAttackIQ released emulations of its TTPs to help organizations validate detection and prevention against the group’s Windows, Linux, and ESXi-focused operations.LinuxAttackIQ released emulations of its TTPs to help organizations validate detection and prevention against the group’s Windows, Linux, and ESXi-focused operations.Microsoft Defender Antimalware PlatformThe group uses defense evasion methods such as disabling Microsoft Defender, deleting shadow copies, and abusing legitimate drivers.Microsoft WindowsAttackIQ released emulations of its TTPs to help organizations validate detection and prevention against the group’s Windows, Linux, and ESXi-focused operations.
Tools
Industries
ConstructionThe activity has particularly affected manufacturing, construction, healthcare, and insurance sectors in Asia-Pacific and South America.HealthcareThe activity has particularly affected manufacturing, construction, healthcare, and insurance sectors in Asia-Pacific and South America.InsuranceThe activity has particularly affected manufacturing, construction, healthcare, and insurance sectors in Asia-Pacific and South America.ManufacturingThe activity has particularly affected manufacturing, construction, healthcare, and insurance sectors in Asia-Pacific and South America.