The Gentlemen RaaS & AdaptixC2 Framework: Multi-Platform Extortion — OTX Pulse Analysis

---
title: Potential SystemBC Proxy Execution
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects execution patterns associated with SystemBC proxy malware often used by The Gentlemen. Looks for processes establishing proxy connections or specific command line arguments.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624a5a5e9f0861e3c8b4567
tags:
    - attack.command_and_control
    - attack.proxy
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\systembc.exe'
            - '\sbclient.exe'
    selection_cli:
        CommandLine|contains:
            - '-proxy'
            - '-connect'
            - 'socks'
    condition: 1 of selection
falsepositives:
    - Legitimate proxy software usage
level: high
---
title: AdaptixC2 Framework Module Execution
id: b2c3d4e5-f6a7-5b6c-9d0e-1f2a3b4c5d6e
description: Detects the execution of known AdaptixC2 modules (MgBot, CoolClient) or the main agent process characteristics mentioned in OTX Pulse analysis.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624a5a5e9f0861e3c8b4568
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - 'mgbot'
            - 'coolclient'
            - 'toneshell'
    selection_cli:
        CommandLine|contains:
            - 'beacon'
            - 'rc4'
            - 'bof'
    condition: 1 of selection
falsepositives:
    - Rare, potential development tools
level: critical
---
title: The Gentlemen Lateral Movement Tools
id: c3d4e5f6-a7b8-6c7d-0e1f-2a3b4c5d6e7f
description: Detects the use of PsExec and AnyDesk, which are frequently used by The Gentlemen affiliates for lateral movement and remote control during ransomware operations.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624a5a5e9f0861e3c8b4569
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: '\\'
    selection_anydesk:
        Image|endswith: '\anydesk.exe'
        CommandLine|contains: 
            - 'start'
            - 'close'
    condition: 1 of selection
falsepositives:
    - Administrative activity
level: medium


kql
// Hunt for specific SHA256 hashes associated with The Gentlemen and AdaptixC2
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where SHA256 in (
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2",
    "cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e"
)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
| extend ThreatContext = case(
    SHA256 == "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235", "The Gentlemen/SystemBC Payload",
    SHA256 == "cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e", "The Gentlemen/SystemBC Variant",
    "Unknown Threat Hash"
);


powershell
# IOC Hunt Script: The Gentlemen & AdaptixC2
# Checks for the presence of specific file hashes and registry keys associated with SystemBC

function Test-FileHashMatch {
    param (
        [string]$Path,
        [string]$ExpectedHash
    )
    if (-not (Test-Path $Path)) { return $false }
    
    $fileHash = Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction SilentlyContinue
    return ($fileHash.Hash -eq $ExpectedHash)
}

# Known IOCs from Pulse Data
$targetHashes = @(
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e",
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2"
)

# Search common execution paths
$pathsToScan = @(
    "$env:TEMP",
    "$env:APPDATA",
    "C:\Windows\Temp",
    "C:\ProgramData"
)

Write-Host "[+] Scanning for The Gentlemen / AdaptixC2 IOCs..."

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($targetHashes -contains $hash) {
                Write-Host "[!] MATCH FOUND: $($_.FullName) | Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

# Check for SystemBC Registry Persistence
$regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
if (Test-Path $regPath) {
    Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue | ForEach-Object {
        if ($_.PSObject.Properties -match "SystemBC" -or $_.PSObject.Properties.Value -match "systembc") {
            Write-Host "[!] SUSPICIOUS PERSISTENCE FOUND IN RUN KEY: $($_.PSObject.Properties)" -ForegroundColor Yellow
        }
    }
}