Check Point Details The Gentlemen Ransomware's GPO-Based Attack Chain
Summary
Check Point Research reconstructs an intrusion involving an affiliate of The Gentlemen RaaS, describing Cobalt Strike, a blocked SystemBC attempt, lateral movement and GPO-based ransomware deployment, and analyzing the locker’s evasion, persistence and encryption.
Key points
- The initial access vector was not determined; the earliest activity established with confidence was attacker presence on a Domain Controller with Domain Admin privileges.
- The attacker deployed Cobalt Strike through administrative shares and RPC. Mimikatz evidence showed credential access, while PsExec, WMI, scheduled tasks and services supported lateral movement.
- An affiliate attempted to deploy SystemBC, but endpoint protection blocked the activity. Telemetry from the SystemBC C2 server showed over 1,570 victims; the report says they were likely mostly organizations and that SystemBC’s relationship to The Gentlemen remains unclear.
- The ransomware was deployed through Group Policy, enabling rapid execution across domain-joined computers.
- The report details attempts to disable Defender and firewalls, delete shadow copies and logs, and establish persistence; an optional mode wipes free disk space.
- The Gentlemen offers Go lockers for Windows, Linux, NAS and BSD, plus a C-based ESXi variant. The analysis describes X25519 and XChaCha20 encryption, including partial-encryption modes for large files.
- The group had publicly claimed more than 320 victims, with most reported attacks occurring in early 2026.
Article Details
- Attack Vectors
- The initial access vector was not determined. The earliest confirmed activity was on a Domain Controller with Domain Admin-level privileges.
- The affiliate deployed Cobalt Strike through administrative shares and RPC. An attempt to deploy SystemBC for proxy communication was blocked by endpoint protection.
- The Windows locker supports propagation using domain credentials, PsExec, WMI, remote scheduled tasks, services and Group Policy. In the investigated incident, Group Policy distributed the locker across domain-joined systems.
- The Windows locker encrypts local and network-accessible files. Its ESXi variant shuts down virtual machines before encrypting targeted files.
- Defensive Notes
- Endpoint protection blocked the observed SystemBC deployment.
- The article provides a YARA rule for detecting the Go-based Windows locker using ransomware-specific strings.
- The locker attempts to disable Defender and firewalls, delete shadow copies and event logs, and optionally overwrite free disk space.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]86[.]230[.]112 | SystemBC command-and-control server contacted during a blocked deployment attempt. |
| IPV4 | 91[.]107[.]247[.]163 | Cobalt Strike command-and-control server contacted by rundll32.exe. |
| SHA256 | 025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c | The Gentlemen Linux ransomware sample hash. |
| SHA256 | 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 2ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 48d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 5dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca | The Gentlemen Linux ransomware sample hash. |
| SHA256 | 62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb8 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19 | The Gentlemen Linux ransomware sample hash. |
| SHA256 | 860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba431158923 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 87d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 992c951f4af57ca7cd8396f5ed69c2199fd6fd4ae5e93726da3e198e78bec0a5 | SystemBC malware sample hash. |
| SHA256 | 994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e3 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | 9f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0ad | The Gentlemen Windows ransomware sample hash. |
| SHA256 | b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108f | The Gentlemen Windows ransomware sample hash. |
| SHA256 | f736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958 | The Gentlemen Windows ransomware sample hash. |
| SHA256 | fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68 | Hash of the ransomware's embedded gentlemen.bmp wallpaper. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe attacker copied Cobalt Strike executables to ADMIN$ shares, while the locker can copy itself to remote C$ shares.T1047 · Windows Management InstrumentationThe locker uses remote WMI process creation to run defense-disabling scripts and ransomware.T1053.003 · CronThe ESXi variant adds a reboot cron entry to relaunch its hidden binary.T1053.005 · Scheduled TaskThe locker creates local startup tasks and remote scheduled tasks to execute its payload.T1059.001 · PowerShellPowerShell downloaded the staged locker and was used for Defender and firewall changes.T1070.001 · Clear Windows Event LogsThe locker clears the System, Application and Security Windows event logs.T1484.001 · Group Policy ModificationThe affiliate used Group Policy to deploy the ransomware to domain-joined systems during policy refresh.T1486 · Data Encrypted for ImpactThe Gentlemen encrypts files on Windows and ESXi, with optional partial-encryption speed modes.T1489 · Service StopThe locker stops services and processes, while the ESXi variant powers off virtual machines before encryption.T1490 · Inhibit System RecoveryThe locker deletes shadow copies and can overwrite free disk space to hinder recovery.T1547.001 · Registry Run Keys / Startup FolderThe Windows locker attempts to add itself to Run registry keys for startup persistence.T1555.004 · Windows Credential ManagerRecovered Mimikatz output showed access to stored credentials from Windows Credential Manager.T1562.001 · Disable or Modify ToolsThe locker disables Defender real-time monitoring and adds process and path exclusions.T1562.004 · Disable or Modify System FirewallThe locker attempts to disable firewall profiles and stop the firewall service.T1569.002 · Service ExecutionThe locker creates and starts remote services such as DefSvc and UpdateSvc to execute its payload.
Threat Actors
Malware
SystemBCIncident response telemetry shows affiliates deploying SystemBC and Cobalt Strike, revealing a botnet of over 1,570 likely corporate victims and demonstrating GPOâbased mass deployment, robust lateral movement, andThe GentlemenThe Gentlemen RaaS has rapidly expanded in early 2026, claiming over 320 victims and offering multiâplatform lockers written in Go for Windows, Linux, NAS and BSD plus a Câbased ESXi variant.
Products
AnyDeskLater, the attacker installed and configured AnyDesk using:DefenderThe operation disables Defender and firewalls, deletes shadow copies and logs, and can overwrite free space to hinder recovery.ESXiThe Gentlemen RaaS has rapidly expanded in early 2026, claiming over 320 victims and offering multiâplatform lockers written in Go for Windows, Linux, NAS and BSD plus a Câbased ESXi variant.LinuxThe Gentlemen RaaS has rapidly expanded in early 2026, claiming over 320 victims and offering multiâplatform lockers written in Go for Windows, Linux, NAS and BSD plus a Câbased ESXi variant.Microsoft WindowsThe Gentlemen RaaS has rapidly expanded in early 2026, claiming over 320 victims and offering multiâplatform lockers written in Go for Windows, Linux, NAS and BSD plus a Câbased ESXi variant.
Tools
Cobalt StrikeIncident response telemetry shows affiliates deploying SystemBC and Cobalt Strike, revealing a botnet of over 1,570 likely corporate victims and demonstrating GPOâbased mass deployment, robust lateral movement, andMimikatzMimikatz output recovered from memory on one of the compromised endpoints showed access to credential material, including domain accounts and stored credentials from Credential Manager.PsExecAttackers achieved Domain Admin presence and propagated via ADMIN$ shares, PsExec, WMI, scheduled tasks, services, and GPO deployment (–gpo/–spread).
Countries
GermanyThere are over 1,570 victims, with the majority located in the United States, followed by the United Kingdom and Germany.United KingdomThere are over 1,570 victims, with the majority located in the United States, followed by the United Kingdom and Germany.United StatesThere are over 1,570 victims, with the majority located in the United States, followed by the United Kingdom and Germany.