Huntress Details Defense Evasion Tactics in Two Gentlemen Ransomware Incidents

Summary

Huntress analyzed two Gentlemen ransomware incidents involving scheduled tasks, PowerShell, Windows log clearing, and attempts to disable Microsoft Defender. One incident included a SOCKS proxy connecting to attacker-controlled IP addresses.

Key points

Huntress investigated two incidents in April and May; post-incident agent deployment limited visibility into initial access and attack activity.
In both incidents, attackers cleared the Security, System, and Application event logs and used scheduled tasks and PowerShell.
In one incident, an attacker connected over RDP using a compromised account; Microsoft Defender blocked an initial encryptor attempt, but a later payload was deployed from a NETLOGON share.
In the second incident, PowerShell commands attempted to disable Defender and add antivirus exclusions before ransomware was redeployed.
A scheduled task launched disguised malware that established a SOCKS proxy to 193.233.202[.]17:44729; another attempted task referenced 77.110.122[.]137:37182.
Huntress recommends enforcing MFA, restricting RDP, monitoring scheduled tasks and Defender changes, and treating log clearing as an escalation trigger.

Article Details

Attack Vectors: Attackers established RDP connections using a compromised user account in the shipping and transportation incident; this was the first observed activity, not confirmed initial access.
In both investigated incidents, attackers used Scheduled Tasks and PowerShell. In one incident, a task launched a SOCKS proxy binary from the Windows Temp folder to maintain remote access.
Attackers attempted to deploy ransomware executables from the Documents folder and Downloads folder; one payload was also executed from a NETLOGON share.
In the construction-company incident, PowerShell commands attempted to disable Microsoft Defender protections and add process and path exclusions.
Defensive Notes: Enforce MFA, restrict RDP, and investigate unusual logons to high-value systems.
Monitor Scheduled Task creation and repeated task failures for signs of persistence or ransomware execution.
Enable Microsoft Defender tamper protection and investigate attempts to disable it or add exclusions.
Treat clearing of Security, System, and Application Event Logs as an immediate escalation trigger.
Maintain an asset inventory, reduce the attack surface, and deploy monitoring broadly.

Indicators of compromise

Type	Indicator	Context
IPV4	`193[.]233[.]202[.]17`	C2 IP address used by the malicious Scheduled Task's SOCKS proxy connection.
IPV4	`77[.]110[.]122[.]137`	Alternate address specified in a command to create a malicious Scheduled Task running the SOCKS proxy binary.
SHA256	`f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8`	SHA-256 hash identified in the IOC table for the second incident's ransomware encryptor.