The Gentlemen RaaS + China-Nexus 'Quartermaster' Espionage Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack

---
title: The Gentlemen Ransomware - PowerRun Privilege Escalation Abuse
id: 9a1f3c2e-7b4d-4e8a-b6c1-2d5f8a9e0c11
status: experimental
description: Detects execution of PowerRun.exe or renamed copies, abused by The Gentlemen (Storm-2697) ransomware affiliates to gain TrustedInstaller-level privileges during pre-encryption preparation.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\powerrun.exe'
    - OriginalFileName: 'PowerRun.exe'
  selection_cli:
    CommandLine|contains:
      - ' -SW '
      - 'TrustedInstaller'
      - '/SW:'
  condition: selection_img or selection_cli
falsepositives:
  - Legitimate administrative use of PowerRun by IT staff (rare in enterprise environments)
level: high
tags:
  - attack.privilege_escalation
  - attack.t1548
  - attack.t1548.002
---
title: The Gentlemen Ransomware - ESXi and Cross-Platform Encryption Staging
id: 2b7e9d4a-5c6f-4a1b-9d3e-8f0a1b2c3d44
status: experimental
description: Detects behaviors associated with The Gentlemen ransomware pre-encryption staging on Windows, including mass file rename activity, shadow copy deletion, and data staging for dual-extortion exfiltration.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
  selection_staging:
    CommandLine|contains:
      - 'rar.exe a '
      - '7z.exe a '
      - '-mx0'
      - 'makecab'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup administration; archive creation by power users
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560
  - attack.t1486
---
title: China-Nexus Quartermaster - QTRouter and Fast Labyrinth Tasking Infrastructure DNS
id: 4c8d2f1b-9e3a-4b7c-a5d6-1e2f3a4b5c66
status: experimental
description: Detects DNS resolution of known quartermaster infrastructure domains and tasking/result hostnames (QScan, QTRouter, Fast Labyrinth) used to support China-nexus cyber espionage operations targeting US/UK critical infrastructure.
author: Security Arsenal Threat Intel
logsource:
  category: dns
  product: windows
detection:
  selection_domain:
    query|contains:
      - 'qt-team.com'
      - 'qtproxy.xyz'
      - 'qt-proxy.org'
      - 'instantmessagehub.tech'
  selection_pattern:
    query|contains:
      - 'mq-task.'
      - 'mq-result.'
  condition: selection_domain or selection_pattern
falsepositives:
  - Security research and threat hunting activity
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1090
  - attack.t1595
date: 2026/08/29

// Hunt: Quartermaster tasking infrastructure + Gentlemen RaaS pre-encryption behavior
// Microsoft Sentinel / Defender XDR — lookback 30 days
let QtInfra = dynamic(["qt-team.com","qtproxy.xyz","qt-proxy.org","instantmessagehub.tech","mq-result-qt-team.com"]);
let GentlemenHashes = dynamic(["30b49ae2f685d4403d3013410f80c2e2","1ecaf7098bedaa4ffae0fff3e077f937","ff709591615a26f037a465ce97cc59d6","68225c5613afe2174ed46e074147676b0f9a3915","8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (QtInfra) or RemoteUrl startswith "mq-task." or RemoteUrl startswith "mq-result."
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName =~ "powerrun.exe"
       or ProcessCommandLine has_any ("vssadmin delete shadows","wmic shadowcopy delete","recoveryenabled no")
       or MD5 has_any (GentlemenHashes)
       or SHA256 has_any (GentlemenHashes)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, MD5, AccountName
)
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (The Gentlemen RaaS + Quartermaster Infrastructure)
# Run elevated on endpoints or via your remote execution / EDR live-response channel.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. File hash sweep (The Gentlemen encryptor/tooling samples) ---
$targetHashes = @(
    '30b49ae2f685d4403d3013410f80c2e2',
    '1ecaf7098bedaa4ffae0fff3e077f937',
    'ff709591615a26f037a465ce97cc59d6',
    '68225c5613afe2174ed46e074147676b0f9a3915',
    '8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db'
)
$searchPaths = @('C:\Users','C:\ProgramData','C:\Windows\Temp')
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } |
        ForEach-Object {
            $h = Get-FileHash -Path $_.FullName -Algorithm SHA256
            $m = Get-FileHash -Path $_.FullName -Algorithm MD5
            if ($targetHashes -contains $h.Hash.ToLower() -or $targetHashes -contains $m.Hash.ToLower()) {
                $findings += [pscustomobject]@{Type='HashMatch'; Path=$_.FullName; Hash=$h.Hash}
            }
        }
}

# --- 2. PowerRun.exe presence (The Gentlemen privilege escalation) ---
$powerRun = Get-ChildItem -Path 'C:\' -Recurse -Filter 'powerrun.exe' -ErrorAction SilentlyContinue
foreach ($p in $powerRun) { $findings += [pscustomobject]@{Type='PowerRun'; Path=$p.FullName; Hash='n/a'} }

# --- 3. Persistence artifacts: suspicious scheduled tasks and run keys ---
$tasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'gent|update|svc|maint' -and
    ($_.Actions.Execute -match 'powershell|rundll32|regsvr32|mshta')
}
foreach ($t in $tasks) { $findings += [pscustomobject]@{Type='SchedTask'; Path=$t.TaskName; Hash=$t.Actions.Execute} }

$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
    (Get-ItemProperty -Path $key).PSObject.Properties |
        Where-Object { $_.Value -match 'Temp|AppData|ProgramData' -and $_.Name -notmatch '^PS' } |
        ForEach-Object { $findings += [pscustomobject]@{Type='RunKey'; Path="$key\$($_.Name)"; Hash=$_.Value} }
}

# --- 4. Quartermaster infrastructure: DNS cache + active connections ---
$qtDomains = 'qt-team.com','qtproxy.xyz','qt-proxy.org','instantmessagehub.tech','mq-result-qt-team.com'
$dnsCache = Get-DnsClientCache | Where-Object {
    $d = $_.Entry; ($qtDomains | ForEach-Object { $d -like "*$_*" }) -contains $true
}
foreach ($d in $dnsCache) { $findings += [pscustomobject]@{Type='DNSCache'; Path=$d.Entry; Hash=$d.Data} }

$conns = Get-NetTCPConnection -State Established |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        [pscustomobject]@{Type='NetConn'; Path=$proc.ProcessName; Hash="$($_.RemoteAddress):$($_.RemotePort)"}
    }
$findings += $conns

# --- 5. Shadow copy status (The Gentlemen deletes backups pre-encryption) ---
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) { $findings += [pscustomobject]@{Type='NoShadowCopies'; Path='VSS'; Hash='Shadow copies deleted - possible staging'} }

$findings | Format-Table -AutoSize
$findings | Export-Csv -Path "$env:TEMP\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Output "Hunt complete. $($findings.Count) findings exported."