The Gentlemen and Qilin Ransomware Rivalry Escalates: Defender's Detection and Response Playbook

Ransomware isn't dying after the disruption of LockBit and ALPHV/BlackCat — it's reorganizing. Two groups, The Gentlemen and Qilin, have emerged as the dominant forces in encryption-based attacks, and according to recent reporting they're actively evolving their tactics to outcompete one another for affiliates, victims, and market supremacy.

For defenders, this rivalry matters more than the scoreboard. Competition between ransomware-as-a-service (RaaS) operators historically produces three things: faster tooling iteration, more aggressive affiliate recruitment, and broader victimology. When two crews fight for dominance, enterprise networks become the battlefield. Both groups operate double-extortion models — encrypt data, steal it first, and threaten publication to force payment — which means a "recovery from backup" strategy alone no longer resolves the incident.

If you run a SOC, an IR retainer, or a security program for a mid-to-large enterprise, this is the moment to re-validate your detections against the behaviors these groups actually exhibit: perimeter device exploitation, living-off-the-land lateral movement, shadow copy destruction, and mass encryption completed within hours of initial access.

Threat Actor Profile: Who You're Defending Against

Qilin

Qilin (also tracked as Agenda) is a mature RaaS operation that has been active since 2022 and surged to top-tier status following the collapse of competing brands in 2024–2025. Key characteristics defenders should internalize:

• Cross-platform payloads: Qilin ships Windows encryptors alongside Linux binaries specifically built to target VMware ESXi hypervisors — encrypting an entire virtualization cluster in a single stroke.
• Rust-based encryptor: The Rust rewrite brought improved performance, per-victim configuration, and evasion features, making static signature detection unreliable.
• Initial access via perimeter exploitation and credential theft: Affiliates routinely enter through exposed VPN/remote access infrastructure and valid accounts harvested via phishing or infostealer logs.
• Destructive pre-encryption staging: Before encryption begins, operators disable backups, delete Volume Shadow Copies, stop security tooling and database services, and modify boot configuration to prevent recovery.

The Gentlemen

The Gentlemen is the newer of the two operations, emerging in mid-2025 and scaling aggressively — a trajectory that suggests experienced operators and an attractive affiliate revenue split. Reported characteristics include:

• Rapid victim accumulation across manufacturing, healthcare, and professional services sectors.
• Emphasis on data theft and extortion pressure, with a professionalized leak-site operation.
• Use of commodity tooling and legitimate administrative utilities for lateral movement — a hallmark of operators who learned their tradecraft in prior RaaS programs.

The practical takeaway: these are not smash-and-grab opportunists. Both groups exhibit the dwell time, staging discipline, and anti-recovery behaviors of professional operations. Your detections must be tuned to the staging phase, because by the time the encryptor runs, your response options shrink to containment and disaster recovery.

The Attack Chain: Where You Can Actually Intercept

While individual intrusions vary, the convergent playbook across both groups looks like this:

1. Initial access — exploitation of internet-facing remote access infrastructure, compromised credentials (often without MFA), or spear phishing delivering a loader.
2. Persistence and privilege escalation — creation of local admin accounts, scheduled tasks, and abuse of legitimate remote management (RMM) tooling like AnyDesk, ScreenConnect, or Splashtop, which blends into enterprise noise.
3. Discovery and lateral movement — net, nltest, adfind, BloodHound collection, and movement over RDP/SMB/WinRM using harvested credentials.
4. Exfiltration staging — Rclone, MEGAsync, or similar tooling pushing data to attacker-controlled cloud storage. This is your last high-confidence interception point before impact.
5. Pre-encryption sabotage — vssadmin delete shadows, bcdedit recovery disabling, mass service termination (databases, backup agents, AV), and clearing of event logs.
6. Detonation — encryption via GPO-pushed or PsExec-deployed encryptors; on virtualized estates, direct encryption of ESXi datastores.

Steps 4 and 5 are where mature SOCs win. Mass shadow copy deletion and boot configuration tampering have essentially zero legitimate enterprise baseline outside of rare admin maintenance windows.

Detection & Response

Sigma Rules

The following rules target the pre-encryption sabotage and exfiltration staging behaviors common to both groups. All three are low-noise in a properly baselined environment.

---
title: Shadow Copy Deletion via Command-Line Tooling
id: 8f2b9c41-3d7e-4a1b-b6c2-9e4f5a6d7c8b
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, diskshadow, or PowerShell — a near-universal pre-encryption behavior in Qilin and The Gentlemen intrusions.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\diskshadow.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Delete-WmiObject'
      - 'Win32_ShadowCopy'
      - 'Remove-CimInstance'
  condition: selection_img and selection_cmd
falsepositives:
  - Backup software maintenance during defined change windows
  - Storage administrators resizing shadow storage on file servers
level: high
---
title: Boot Recovery and Safe Mode Tampering via bcdedit
id: 4c1d7e92-6a3b-4f58-9d21-7b8c9a0e1f2d
status: experimental
description: Detects bcdedit modifications disabling recovery mode or boot status policy, used by ransomware operators to prevent endpoint recovery prior to encryption.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - '{default}'
  condition: selection
falsepositives:
  - Rare OS deployment or imaging scripts — scope to change windows
level: high
---
title: Cloud Exfiltration Tool Execution from Non-Standard Path
id: 9e3a5b17-2c8d-4e6f-a1b4-5d6c7e8f9a0b
status: experimental
description: Detects execution of Rclone or similar cloud sync tooling from user-writable or temporary paths, consistent with ransomware exfiltration staging observed in RaaS intrusions.
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\megacmd.exe'
  selection_path:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '\Downloads\'
  condition: selection_img and selection_path
falsepositives:
  - Legitimate rclone deployments installed system-wide would not match the path criteria
level: high

KQL Hunt — Microsoft Sentinel / Defender XDR

This query hunts the combined pre-encryption sabotage pattern — shadow copy destruction and boot tampering — plus mass service termination, which frequently fires in bursts minutes before detonation. Run it as a hunting query over 7 days and consider promoting the shadow copy component to an analytic rule with a suppression window for backup maintenance.

let SuspectTools = dynamic(["vssadmin.exe", "wmic.exe", "bcdedit.exe", "diskshadow.exe"]);
let SuspectArgs = dynamic(["delete shadows", "shadowcopy delete", "resize shadowstorage", "recoveryenabled no", "ignoreallfailures", "Win32_ShadowCopy"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (SuspectTools)
| where ProcessCommandLine has_any (SuspectArgs)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Source="MDE"),
(SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where NewProcessName has_any (SuspectTools)
| where CommandLine has_any (SuspectArgs)
| project TimeGenerated, DeviceName=Computer, AccountName=Account, FileName=NewProcessName, ProcessCommandLine=CommandLine, InitiatingProcessFileName=ParentProcessName, InitiatingProcessCommandLine="", Source="SecurityEvent")
| extend SabotageType = case(
    ProcessCommandLine has "bcdedit", "BootConfigTampering",
    ProcessCommandLine has "shadow", "ShadowCopyDeletion",
    "Other")
| summarize ExecutionCount=count(), Hosts=dcount(DeviceName), LastSeen=max(TimeGenerated)
  by SabotageType, DeviceName, AccountName, ProcessCommandLine, Source
| sort by LastSeen desc

For the exfiltration angle, hunt outbound transfers to consumer cloud storage from servers — a strong pre-ransomware signal:

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceType has_any ("server", "domaincontroller")
| where InitiatingProcessFileName has_any ("rclone", "megasync", "megacmd", "7z", "rar", "winscp", "filezilla")
| where RemoteUrl has_any ("mega.nz", "mega.co.nz", "dropbox", "sync.com", "pcloud", "backblazeb2", "amazonaws.com", "digitaloceanspaces")
   or RemoteIPType == "Public"
| summarize Connections=count(), DistinctDestinations=dcount(RemoteIP), TotalBytesSentEstimate=sum(1)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| sort by Connections desc

Velociraptor VQL Hunt

This artifact sweeps endpoints for the executables and artifacts most relevant to both groups' staging phase: renamed copies of recovery tools, cloud exfiltration binaries in user-writable paths, and evidence of shadow copy deletion in process execution history (via Amcache/Shimcache-adjacent artifacts where available). At minimum, the pslist/netstat combination below identifies live exfiltration processes and their destinations across your fleet.

-- Hunt for live exfiltration tooling and pre-encryption sabotage processes across the fleet
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy|bcdedit.*recoveryenabled|ignoreallfailures)'
   OR Name =~ '(?i)^(rclone|megasync|megacmd|restic|7z|winrar|rar)\.exe$'
   OR (Name =~ '(?i)anydesk|screenconnect|splashtop|teamviewer'
       AND Exe =~ '(?i)(users\\public|appdata\\local\\temp|programdata|windows\\temp)')

-- Correlate suspicious processes with active outbound connections
SELECT n.Pid AS Pid, n.Name AS ProcessName, n.ProcessPath AS Path,
       n.RemoteAddr AS RemoteAddr, n.RemotePort AS RemotePort,
       n.Status AS ConnStatus
FROM netstat()
WHERE n.Status =~ 'ESTAB'
  AND (n.Name =~ '(?i)rclone|megasync|restic|pscp|winscp'
       OR (n.RemotePort in (443, 22, 21)
           AND n.ProcessPath =~ '(?i)(users\\public|appdata\\local\\temp|windows\\temp|programdata\\[^\\]+\.exe)'))

-- Sweep for encryptor artifacts: ransom notes and mass-renamed extensions in high-value directories
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/Desktop/*README*.txt')
WHERE Size < 10000

Note: ransom-note filenames vary per affiliate and campaign — treat the third query as a lead generator and pair it with file-creation velocity monitoring on file servers rather than a standalone alert.

Remediation and Hardening Script

The following PowerShell script performs a three-part action: (1) verifies Volume Shadow Copies exist and are not being suppressed, (2) enables Controlled Folder Access on endpoints where it isn't active, and (3) audits for unauthorized cloud-exfiltration tooling and recently created local admin accounts. Run it via your RMM or GPO startup script during your next maintenance cycle; it is read-mostly and safe for broad deployment.

# Security Arsenal - Ransomware Readiness Verification & Hardening
# Targets pre-encryption sabotage vectors used by Qilin / The Gentlemen
# Run as SYSTEM or elevated administrator. Review before production use.

$Report = @()

# --- 1. Verify Volume Shadow Copy health ---
$Shadows = Get-CimInstance -ClassName Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) {
    $Report += "[OK] $($Shadows.Count) shadow copies present."
} else {
    $Report += "[WARN] No shadow copies found. Enabling System Protection on C:."
    Enable-ComputerRestore -Drive "C:\" -ErrorAction SilentlyContinue
    vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10% | Out-Null
}

# --- 2. Verify/enable Controlled Folder Access (Defender anti-ransomware) ---
$CFA = Get-MpPreference | Select-Object -ExpandProperty EnableControlledFolderAccess
if ($CFA -eq 1) {
    $Report += "[OK] Controlled Folder Access is ENABLED."
} else {
    $Report += "[WARN] Controlled Folder Access not enabled ($CFA). Enabling in Audit mode first."
    Set-MpPreference -EnableControlledFolderAccess AuditMode
    $Report += "[ACTION] Review 30 days of CFA audit events, then: Set-MpPreference -EnableControlledFolderAccess Enabled"
}

# --- 3. Audit for cloud exfiltration tooling in user-writable paths ---
$SuspectPaths = @("$env:PUBLIC", "$env:TEMP", "C:\ProgramData", "C:\Windows\Temp")
$SuspectTools = @("rclone.exe", "megasync.exe", "megacmd.exe", "restic.exe")
foreach ($Path in $SuspectPaths) {
    $Found = Get-ChildItem -Path $Path -Recurse -Include $SuspectTools -ErrorAction SilentlyContinue
    foreach ($F in $Found) {
        $Report += "[ALERT] Exfiltration-capable tool found: $($F.FullName) (Created: $($F.CreationTime))"
    }
}

# --- 4. Audit local administrators created in the last 14 days ---
$Cutoff = (Get-Date).AddDays(-14)
$NewAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    Where-Object { $_.ObjectClass -eq "User" } |
    ForEach-Object {
        $u = Get-LocalUser -Name ($_.Name -split '\\')[-1] -ErrorAction SilentlyContinue
        if ($u -and $u.PasswordLastSet -gt $Cutoff) { $u }
    }
foreach ($A in $NewAdmins) {
    $Report += "[ALERT] Local admin with recent password set: $($A.Name) ($($A.PasswordLastSet)) - verify legitimacy"
}

# --- 5. Verify event log service and RDP exposure ---
$EvtLog = Get-Service -Name EventLog
$Report += "[INFO] Event Log service: $($EvtLog.Status)"
$RDP = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
if ($RDP.fDenyTSConnections -eq 0) {
    $Report += "[INFO] RDP is ENABLED - confirm MFA gateway / VPN-only exposure"
}

$Report | Out-File -FilePath "C:\ProgramData\RansomwareReadiness_$(Get-Date -Format 'yyyyMMdd').log" -Append
$Report | ForEach-Object { Write-Output $_ }

Remediation and Hardening Priorities

Because no single CVE is attached to this campaign, remediation is about closing the access and impact paths both groups share. Prioritize in this order:

1. Eliminate the initial access vectors.

• Patch and inventory every internet-facing remote access appliance (VPN concentrators, firewalls, remote access gateways). Qilin affiliates in particular have repeatedly entered through perimeter devices — maintain a 72-hour patch SLA for edge infrastructure.
• Enforce phishing-resistant MFA (FIDO2/passkeys where feasible) on all remote access, and audit for accounts that bypass it — service accounts and legacy VPN profiles are the usual gaps.
• Block or alert on unauthorized RMM tooling. Both groups lean on legitimate remote management software for hands-on-keyboard access; an allowlist approach converts their tradecraft into a detection.

2. Make backups un-deletable.

• Move to immutable backup storage (object-lock, WORM, or hardened repositories). Shadow copy deletion is trivially easy; an immutable off-host backup is not.
• Test restoration monthly against a realistic scenario: domain controllers and virtualization layer gone simultaneously. Both groups target ESXi — if your recovery plan assumes a functioning hypervisor cluster, it will fail exactly when you need it.

3. Break the exfiltration leverage.

• Deploy egress filtering that restricts outbound traffic from servers to approved destinations. Blocking consumer cloud storage (MEGA, Dropbox, and similar) from server subnets removes the easiest double-extortion channel.
• Classify and encrypt sensitive data at rest. Stolen encrypted data still triggers notification obligations in most jurisdictions, but it changes the attacker's leverage calculus.

4. Detonate the encryptor early or not at all.

• Enable Microsoft Defender's Controlled Folder Access in audit mode now, enforce after baselining (the script above handles step one).
• Deploy decoy/canary files on file servers and alert on any modification — mass encryption touches canaries within seconds of detonation and provides a high-fidelity tripwire with near-zero false positives.
• Isolate the virtualization control plane: ESXi hosts should never be domain-joined, management interfaces should sit on a segmented network with MFA'd jump access, and the vCenter credential should be vaulted with check-out alerting.

5. Rehearse the response.

• Run a tabletop exercise specifically against the dual-impact scenario: encrypted hypervisor cluster plus a data-leak threat. Legal, communications, and executives must understand the extortion decision tree before they're inside it.
• Pre-stage forensic collection: enable PowerShell Script Block Logging, process creation auditing with command line (Event ID 4688), and Sysmon where licensed — the detections above depend on this telemetry existing when the incident starts, not after.

Bottom Line

The Gentlemen–Qilin rivalry is a market signal, not an anomaly. As long as ransomware remains profitable, competition will keep driving tooling improvements and affiliate aggression. The defensive answer hasn't changed in principle — deny the perimeter, detect the staging, survive the detonation — but the margin for slow detection has. Both groups can move from initial access to domain-wide encryption within a single weekend. If your mean-time-to-detect on shadow copy deletion and boot tampering is measured in days rather than minutes, that is the gap to close this quarter.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub