cyber.hendryadrian.com
Security News · bankinfosecurity.com

Leaked Chats Expose The Gentlemen Ransomware Group’s Tactics

· Original article ↗

Summary

A leak reportedly containing 8,200 lines of The Gentlemen’s internal chats reveals alleged use of compromised Fortinet credentials, ZeroPulse, defense evasion and backup targeting; researchers say the group patched its malware after a decryptor appeared.

Key points

  • The leaked material reportedly includes about 8,200 lines of internal chat and images of infected systems.
  • The chats discuss gaining VPN access, using OpenConnect, and pushing payloads with command-and-control software, according to a threat intelligence expert who reviewed the data.
  • Messages suggest intrusions often began with compromised Fortinet edge-device credentials and involved ZeroPulse for remote administration.
  • Researchers say the group conducted reconnaissance and targeted virtualization infrastructure, NAS devices, critical servers and backups, while discussing ways to disable security tools.
  • S-RM reported that The Gentlemen had listed more than 340 non-paying victims on its leak site by April; the number of victims who paid is unclear.
  • ZeroFox researchers said the group issued a same-day malware patch in April after Bedrock Safeguard released a free decryptor.

Article Details

Event Type
Data breach and public leak of internal communications from The Gentlemen ransomware group.
Impact
The leaked material reportedly includes about 8,200 lines of internal chats, images of infected systems, infrastructure details, and information about the group’s tactics and operations. The chats suggest the group compromised an organization that appears to do business with Sony and Barclays and threatened to release stolen NDAs if it was not paid; the article’s update clarifies that the NDAs were stolen from that organization, not from Sony or Barclays.

MITRE ATT&CK

T1078 · Valid AccountsThe article says intrusions often began with compromised credentials for Fortinet edge networking gear.T1133 · External Remote ServicesThe leaked chats reportedly discuss gaining access through victims’ VPN connections.T1484.001 · Group Policy ModificationThe group reportedly discussed modifying Group Policy Objects.T1486 · Data Encrypted for ImpactThe group uses ransomware to encrypt systems across victim networks.T1490 · Inhibit System RecoveryThe article describes efforts to disrupt backup and storage systems to prevent recovery after encryption.T1562.001 · Disable or Modify ToolsThe group reportedly discussed disabling endpoint security tools and evading endpoint detection and response tools.

People

Milivoj RajićAs head of threat intelligence at DynaRisk, he reviewed the leaked data and described what the messages reportedly revealed about the group’s operations and tactics.

Threat Actors

The GentlemenA ransomware-as-a-service group. Leaked internal chats reportedly reveal its victim access methods, reconnaissance, efforts to disable defenses and backups, and preparation for network-wide encryption.

Vendors

FortinetThe leaked material shows repeated reliance on compromised credentials, Fortinet edge devices, living-off-the-land techniques, and aggressive efforts to disable defenses and target backups, NAS systems, and critical

Products

BSDtrumpeting the power of its Go-based malware to deliver “silent encryption,” across Windows, Linux, NAS, BSD and ESXi systems, said cybersecurity firm ZeroFox.ESXithe power of its Go-based malware to deliver “silent encryption,” across Windows, Linux, NAS, BSD and ESXi systems, said cybersecurity firm ZeroFox.Linuxsites, trumpeting the power of its Go-based malware to deliver “silent encryption,” across Windows, Linux, NAS, BSD and ESXi systems, said cybersecurity firm ZeroFox.Microsoft Active Directorydetection and response tools, modify Group Policy Objects and gain “domain admin” privileges in Active Directory, giving them unrestricted access to an IT environment, Rajić said.Microsoft Exchange ServerThe challenge of “fake CVE scripts.” The document dump includes bitcoin wallet addresses they use to exchange funds internally and purchase equipment.Microsoft Windowsdarkweb sites, trumpeting the power of its Go-based malware to deliver “silent encryption,” across Windows, Linux, NAS, BSD and ESXi systems, said cybersecurity firm ZeroFox.

Tools

openconnectof a modern day ransomware-as-a-service group: Gaining access to a victim’s VPN connections, using OpenConnect, questions about how to use command-and-control software to push payloads, he said.ZeroPulse#TheGentlemen

Countries

ThailandThe Gentlemen already amassed more than a dozen victims in Thailand and the United States by the time researchers cataloged it as an ongoing cybercrime enterprise.United StatesThe Gentlemen already amassed more than a dozen victims in Thailand and the United States by the time researchers cataloged it as an ongoing cybercrime enterprise.

Industries

HealthcareBy the end of last year, the group’s list of victims included manufacturing, healthcare and insurance organizations, plus a Christmastime disruption of Romanian state-owned power producer Complexul Energetic Oltenia.InsuranceBy the end of last year, the group’s list of victims included manufacturing, healthcare and insurance organizations, plus a Christmastime disruption of Romanian state-owned power producer Complexul Energetic Oltenia.ManufacturingBy the end of last year, the group’s list of victims included manufacturing, healthcare and insurance organizations, plus a Christmastime disruption of Romanian state-owned power producer Complexul Energetic Oltenia.

Related Articles