title: Potential The Gentlemen Reconnaissance Activity
date: 2026/07/29
description: Detects the use of reconnaissance tools SharpADWS, NetScan, or Advanced IP Scanner associated with The Gentlemen RaaS group.
status: experimental
author: Security Arsenal
references:
    - https://securelist.com/the-gentlemen-raas/120447/
tags:
    - attack.reconnaissance
    - attack.t1595.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\sharpadws.exe'
            - '\netsh.exe'
            - '\advanced_ip_scanner.exe'
    condition: selection
falsepositives:
    - Authorized administrative scanning
level: high
---
title: Suspicious GPO Script Creation (The Gentlemen)
date: 2026/07/29
description: Detects creation of script files in the SYSVOL path which may indicate GPO-based deployment tactics used by The Gentlemen.
status: experimental
author: Security Arsenal
references:
    - https://securelist.com/the-gentlemen-raas/120447/
tags:
    - attack.persistence
    - attack.t1484.001
logsource:
    category: file_create
    product: windows
detection:
    selection:
        TargetFilename|contains: '\\SYSVOL\\'
        TargetFilename|endswith:
            - '.bat'
            - '.ps1'
            - '.vbs'
    condition: selection
falsepositives:
    - Legitimate GPO administration
level: medium
---
title: BlueShell Proxy C2 Connection Pattern
date: 2026/07/29
description: Detects potential BlueShell C2 communication via suspicious proxy behavior or high-entropy outbound connections typical of Go-based RATs.
status: experimental
author: Security Arsenal
references:
    - https://sect.iij.ad.jp/blog/2026/07/blueshell-variant-deployed-by-apt-group/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationPort|between:
            - 80
            - 443
    filter:
        DestinationHostname|contains:
            - 'microsoft.com'
            - 'windowsupdate.com'
    condition: selection and not filter
falsepositives:
    - Standard web browsing
level: low


kql
// Hunt for IOCs related to Flying Eagle, The Gentlemen, and BlueShell
// File Hashes
let FileHashes = dynamic([
    "18827998ad05c58da1d218066374fe16", "645ee92d197441684919c0b1ad5cfd15", "b5f64311ffe3c6f1eb13b769663702c6", // Flying Eagle MD5
    "9321a61a25c7961d9f36852ecaa86f55", "b6b51508ad6f462c45fe102c85d246c8", // The Gentlemen MD5
    "fdc9e765546c72841221b86fe1383c37" // BlueShell MD5
]);
// Domains
let Domains = dynamic(["110gongan.com", "activedirectory.ds-lds.tools"]);

DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in FileHashes or MD5 in FileHashes 
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl has_any (Domains) 
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName
)


powershell
# IOC Hunt Script for Flying Eagle, The Gentlemen, and BlueShell
# Requires Admin privileges

$MD5Indicators = @( 
    "18827998ad05c58da1d218066374fe16", "645ee92d197441684919c0b1ad5cfd15", 
    "9321a61a25c7961d9f36852ecaa86f55", "fdc9e765546c72841221b86fe1383c37"
)

Write-Host "[+] Scanning for file artifact indicators..."

# Scan common download directories and temp folders
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\Windows\Temp")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $MD5Indicators) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | MD5: $hash" -ForegroundColor Red
            }
        }
    }
}

# Check for suspicious network connections (The Gentlemen / BlueShell C2)
Write-Host "[+] Checking for active connections to suspicious domains..."
$Domains = @("110gongan.com", "activedirectory.ds-lds.tools")
$activeConnections = Get-NetTCPConnection | Select-Object -ExpandProperty RemoteAddress | ForEach-Object { 
    try { [System.Net.Dns]::GetHostEntry($_).HostName } catch { $_ } 
}

foreach ($conn in $activeConnections) {
    if ($Domains -like "*$conn*") {
        Write-Host "[!] SUSPICIOUS CONNECTION DETECTED: $conn" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt complete."


# Response Priorities

**Immediate:**
*   Block all listed domains and IP addresses at the firewall and proxy level.
*   Isolate any endpoints with positive hash matches for Flying Eagle or SharkLoader.
*   Initiate threat hunting for SharpADWS and Advanced IP Scanner execution logs.

**24h:**
*   Enforce strict MFA and access reviews for VPN and firewall accounts (The Gentlemen vector).
*   Conduct credential resets for finance and admin teams in targeted regions (China, Thailand, Japan) due to credential theft capabilities (Flying Eagle) and reconnaissance (The Gentlemen).
*   Review GPOs for unauthorized script deployments (SYSVOL).

**1 Week:**
*   Patch internet-facing VPNs and firewalls against known exploits.
*   Implement network segmentation to limit lateral movement common to The Gentlemen and BlackTech operations.
*   Enhance mobile device management (MDM) policies to block sideloading of apps (mitigates Flying Eagle APK distribution).