The Gentlemen RaaS + Hangro DPRK Infrastructure + Help TDS: OTX Multi-Campaign Intelligence — Enterprise Detection Pack

Three concurrent OTX pulses published this week paint a picture of a threat landscape where financially motivated ransomware operators, state-aligned infrastructure, and industrialized scam delivery networks are all maturing simultaneously. This briefing synthesizes intelligence on The Gentlemen ransomware-as-a-service operation, North Korea's Hangro VPN/mail ecosystem, and the Hotejka / Help TDS tech-support scam distribution network — with detection content SOC teams can deploy today.

Threat Summary

Three distinct but strategically relevant threat clusters emerged from this collection window:

1. The Gentlemen RaaS (Highest Immediate Risk). A Russian-speaking ransomware-as-a-service group that emerged in mid-2025 after operating as an affiliate of LockBit and Qilin. The group offers affiliates up to 90% of ransom revenue and has claimed over 800 victims across manufacturing, technology, healthcare, retail, education, finance, government, energy, and transportation — with the United States as the primary target geography. The operation uses a double-extortion model: data exfiltration followed by encryption of Windows, Linux, NAS, and BSD systems using ChaCha20 encryption. Critically, the toolkit includes an EDR-killer component leveraging a vulnerable driver (BYOVD — Bring Your Own Vulnerable Driver, CVE-2025-70795) and PsExec-based lateral movement. Associated tooling overlaps with ArmCorp and Phantom Mantis clusters. A dedicated Tor-based leak site and negotiation portal has been identified.

2. North Korea's Hangro Revisited (Strategic / Collection Interest). Updated analysis of Hangro, the DPRK state VPN and mail product operating from Pyongyang and the Russian Far East. A new certificate hierarchy deployed in July 2026 differs significantly from the 2024 version, and both contain cryptographic anomalies where signatures fail verification — a fingerprint useful for identifying DPRK-operated infrastructure. The investigation uncovered six network assignments in Chinese address space and exposed mail relay systems tied to silibank (a North Korean financial front). Any organization observing traffic to .net.kp space or associated front domains should treat it as a high-fidelity indicator of either compromise, sanctions exposure, or targeted collection.

3. Help TDS / Hotejka (Volume Threat to End Users). A Russian-language affiliate program operating since April 2017, believed to be a rebrand of ROI777, running the Help Traffic Distribution System. Help TDS uses browser fingerprinting and geolocation to redirect victims — via compromised websites, malvertising, social media, and spam — to fake Microsoft security alerts that lock the browser and push victims toward installing UltraViewer (legitimate remote access tooling abused for fraud). The operation abuses Cloudflare Pages for hosting, complicating takedown and reputation-based blocking. Targeted countries include the US, Australia, Belgium, Canada, France, Japan, and Sweden.

Collective objective: financial gain through extortion and fraud at scale, plus state-level infrastructure maintenance in the DPRK case. The common thread for defenders is the abuse of legitimate infrastructure (Cloudflare Pages, PsExec, signed-but-vulnerable drivers, UltraViewer) that defeats naive blocklist-based controls.

Threat Actor / Malware Profiles

The Gentlemen (RaaS)

• Distribution: Affiliate-driven intrusion set; initial access via exploitation of exposed services and valid accounts, consistent with LockBit/Qilin tradecraft heritage. The CVE-2025-70795 tag indicates exploitation of a specific vulnerable driver during the intrusion lifecycle.
• Payload behavior: Multi-platform encryptors (Windows, Linux, NAS, BSD) using the ChaCha20 stream cipher. Double extortion — bulk data exfiltration precedes encryption to maximize leverage.
• EDR-killer: Deploys a vulnerable signed driver to terminate security products from kernel context (BYOVD / T1562.001 — Impair Defenses). Watch for driver load events immediately preceding mass security-service termination.
• Lateral movement: PsExec-style service execution (T1569.002) for mass deployment of the encryptor across domain-joined hosts.
• C2 / victim interaction: Negotiation and leak operations hosted on Tor: tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion.
• Anti-analysis: Kernel-level defense impairment, cross-platform builds to hinder single-OS sandboxing, and fast affiliate churn that rotates binaries and infrastructure.

Hangro (DPRK State Infrastructure)

• Nature: State VPN and mail relay product hosted in Pyongyang and the Russian Far East, with network assignments inside Chinese address space — classic DPRK cross-border infrastructure camouflage.
• Key fingerprint: A July 2026 certificate hierarchy whose signatures fail cryptographic verification. Invalid-signature certificates on .net.kp and front domains (e.g., silibank.com) are a reliable attribution signal.
• Infrastructure of note: mail.silibank.net.kp, smtp.star-co.net.kp, hangro.net.kp, mail.silibank.com, ps.ppokkugi.com — mail relay and VPN endpoints consistent with sanctions-evasion and financial-front activity.

Help TDS / Hotejka

• Distribution: Malvertising, compromised sites, social media lures, and spam feeding into a Traffic Distribution System that fingerprints browsers and geolocates victims before redirecting to scam landing pages.
• Payload behavior: Fake Microsoft security alerts that lock the browser (browser locker technique) and socially engineer victims into installing UltraViewer, granting operators direct remote access for banking fraud and data theft.
• Infrastructure: Cloudflare Pages abuse for resilient hosting; rotating CNAME chains (hotcname.help) and disposable domains (fosetya.shop, goalods.lol, roi-traffic.icu, hotejka.ink, lib1.biz, roi777.com) behind IP 91.196.33.144.
• Anti-analysis: Geofencing and fingerprinting ensure sandboxes and out-of-region scanners receive benign content (cloaking — a hallmark of mature TDS operations).

IOC Analysis

The pulse collection contains four operational indicator classes:

Tooling for decode/pivot: AbuseIPDB and GreyNoise for IP reputation; urlscan.io and VirusTotal for domain detonation history; crt.sh for certificate pivots on Hangro/Silibank infrastructure; MalwareBazaar hash lookups for the listed samples. For TDS infrastructure, Infoblox-style predictive DNS (registration-pattern blocking) is more effective than reactive domain feeds, given disposable-domain churn.

Detection Engineering

---
title: The Gentlemen RaaS - BYOVD Vulnerable Driver Load Followed by Security Tool Termination
id: 7f3a1c2e-9b4d-4e6a-a1f2-8c5d7e9f0a11
status: experimental
description: Detects load of a vulnerable driver (CVE-2025-70795 pattern) followed by termination of EDR/security services, consistent with The Gentlemen ransomware EDR-killer component.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
references:
  - https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/
logsource:
  category: driver_load
  product: windows
detection:
  selection_hashes:
    - Hashes|contains:
        - 'SHA256=1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f'
        - 'SHA256=dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70'
        - 'MD5=698ce57e5f0ecda7b41d2c6c1e7ca177'
        - 'MD5=736a6b312fe80efea9bc2e482629be06'
  selection_path:
    ImageLoaded|endswith: '.sys'
  filter_known_signed:
    Signed: 'true'
    SignatureStatus: 'valid'
  condition: selection_hashes or (selection_path and not filter_known_signed)
falsepositives:
  - Legitimate but uncommon third-party drivers; baseline driver inventory recommended
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1068
---
title: PsExec-Style Remote Service Creation for Mass Ransomware Deployment
id: 8a4b2d3f-0c5e-5f7b-b2a3-9d6e8f0a1b22
status: experimental
description: Detects PsExec-like lateral movement via remote service creation over ADMIN$ with service binary execution, consistent with The Gentlemen mass-encryption deployment tradecraft.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
logsource:
  product: windows
  service: security
  definition: Event ID 7045 (Service Control Manager) or 4697
detection:
  selection_psexec:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
  selection_suspicious_svc:
    ImagePath|contains:
      - '\ADMIN$'
      - '\IPC$'
      - '\Temp\'
      - '\Users\Public\'
  condition: selection_psexec or selection_suspicious_svc
falsepositives:
  - Legitimate admin tooling (SCCM, PDQ Deploy); correlate with approved software deployment windows
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
---
title: Help TDS / Hotejka - DNS Resolution of Known Scam and DPRK Front Infrastructure
id: 9b5c3e4a-1d6f-6a8c-c3b4-0e7f9a1b2c33
status: experimental
description: Detects DNS queries for Help TDS (Hotejka/ROI777) distribution domains, UltraViewer scam lure domains, and DPRK Hangro/Silibank mail relay infrastructure.
author: Security Arsenal Threat Intelligence
date: 2026/10/21
logsource:
  category: dns
detection:
  selection_tds:
    query|endswith:
      - 'roi777.com'
      - 'roi-traffic.icu'
      - 'hotejka.ink'
      - 'lib1.biz'
      - 'fosetya.shop'
      - 'goalods.lol'
      - 'hotcname.help'
  selection_dprk:
    query|endswith:
      - '.net.kp'
      - 'silibank.com'
      - 'ppokkugi.com'
  condition: selection_tds or selection_dprk
falsepositives:
  - Threat research activity; verify against sanctioned research hosts
level: critical
tags:
  - attack.command_and_control
  - attack.t1071

// Security Arsenal - Multi-Campaign Hunt: The Gentlemen RaaS + Help TDS + Hangro/DPRK infrastructure
// Covers: IOC network beacons, UltraViewer install/execution, PsExec lateral movement, driver-load defense evasion
let GentlemenHashes = dynamic(["1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f","dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70"]);
let TDSDomains = dynamic(["roi777.com","roi-traffic.icu","hotejka.ink","lib1.biz","fosetya.shop","goalods.lol","hotcname.help"]);
let DPRKDomains = dynamic(["silibank.com","silibank.net.kp","star-co.net.kp","hangro.net.kp","ppokkugi.com"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where Timestamp > ago(30d)
   | where RemoteUrl has_any (TDSDomains) or RemoteUrl has_any (DPRKDomains) or RemoteIP == "91.196.33.144"
   | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
   | extend Hunt = "Network IOC"),
  (DeviceProcessEvents
   | where Timestamp > ago(30d)
   | where SHA256 in~ (GentlemenHashes)
      or FileName =~ "UltraViewer.exe"
      or ProcessCommandLine has_any ("PSEXESVC", "\\ADMIN$\\")
      or (FileName =~ "sc.exe" and ProcessCommandLine has "stop" and ProcessCommandLine has_any ("Sense","MsMpSvc","CSFalconService","SentinelAgent"))
   | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
   | extend Hunt = "Process / Defense Evasion"),
  (DeviceEvents
   | where Timestamp > ago(30d)
   | where ActionType == "DriverLoad" or ActionType has "Driver"
   | where SHA256 in~ (GentlemenHashes)
   | project Timestamp, DeviceName, ActionType, FileName, SHA256, FolderPath
   | extend Hunt = "BYOVD Driver Load")
| sort by Timestamp desc

# Security Arsenal - Endpoint IOC Hunt: The Gentlemen RaaS + Help TDS artifacts
# Run via EDR live response or PS remoting across fleet. Requires elevated privileges.

$report = [System.Collections.Generic.List[object]]::new()

# 1) The Gentlemen - known file hashes on disk (encryptor / EDR-killer driver)
$hashes = @(
  '1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f',
  'dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70'
)
$searchPaths = @("$env:TEMP","$env:PUBLIC","$env:ProgramData","C:\Windows\Temp","C:\Users\Public","C:\Windows\System32\drivers")
foreach ($p in $searchPaths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      try {
        $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
        if ($hashes -contains $h.ToLower()) {
          $report.Add([pscustomobject]@{Check='MaliciousHash'; Path=$_.FullName; SHA256=$h; Host=$env:COMPUTERNAME})
        }
      } catch {}
    }
  }
}

# 2) EDR-killer evidence - recently loaded third-party drivers + stopped security services
Get-CimInstance Win32_SystemDriver | Where-Object {
  $_.PathName -notlike '*\Windows\System32\drivers\*' -and $_.State -eq 'Running'
} | ForEach-Object {
  $report.Add([pscustomobject]@{Check='NonStandardDriver'; Path=$_.PathName; SHA256=''; Host=$env:COMPUTERNAME})
}
$secSvcs = @('WinDefend','Sense','CSFalconService','SentinelAgent','Sophos','ekrn','MBAMService')
foreach ($s in $secSvcs) {
  $svc = Get-Service -Name $s -ErrorAction SilentlyContinue
  if ($svc -and $svc.Status -eq 'Stopped') {
    $report.Add([pscustomobject]@{Check='SecurityServiceStopped'; Path=$s; SHA256=''; Host=$env:COMPUTERNAME})
  }
}

# 3) PsExec / lateral movement service artifacts
Get-CimInstance Win32_Service | Where-Object {
  $_.Name -match 'PSEXESVC|PAExec' -or $_.PathName -match 'ADMIN\$|Users\\Public|\\Temp\\'
} | ForEach-Object {
  $report.Add([pscustomobject]@{Check='SuspiciousService'; Path=$_.PathName; SHA256=$_.Name; Host=$env:COMPUTERNAME})
}

# 4) Help TDS / UltraViewer - unauthorized RMM install + DNS cache for scam domains
$uvPaths = @("$env:ProgramFiles\UltraViewer","${env:ProgramFiles(x86)}\UltraViewer","$env:APPDATA\UltraViewer")
foreach ($p in $uvPaths) {
  if (Test-Path $p) {
    $report.Add([pscustomobject]@{Check='UltraViewerInstall'; Path=$p; SHA256=''; Host=$env:COMPUTERNAME})
  }
}
$badDomains = 'roi777.com','roi-traffic.icu','hotejka.ink','lib1.biz','fosetya.shop','goalods.lol','hotcname.help','silibank.com','net.kp'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $badDomains) {
  $hit = $dns | Where-Object { $_.Entry -like "*$d*" }
  if ($hit) {
    $hit | ForEach-Object { $report.Add([pscustomobject]@{Check='DNSCacheHit'; Path=$_.Entry; SHA256=$_.Data; Host=$env:COMPUTERNAME}) }
  }
}

# 5) Active connections to known-bad IP
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -eq '91.196.33.144' } |
  ForEach-Object { $report.Add([pscustomobject]@{Check='BadIPConnection'; Path="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort)"; SHA256=$_.OwningProcess; Host=$env:COMPUTERNAME}) }

if ($report.Count -gt 0) { $report | Format-Table -AutoSize; $report | Export-Csv -Path ".\ioc_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }
else { Write-Host "[+] No indicators found on $env:COMPUTERNAME" }

Response Priorities

Immediate (0–24h)

• Block all listed IOCs: sinkhole Help TDS domains (roi777.com, roi-traffic.icu, hotejka.ink, lib1.biz, fosetya.shop, goalods.lol, hotcname.help) and DPRK front domains (silibank.com, all .net.kp); block egress to 91.196.33.144; push the four Gentlemen file hashes into EDR prevention policy.
• Hunt for BYOVD precursors: any unsigned/non-standard driver loads in the last 30 days, and any security-service stop events that were not admin-initiated. This is the pre-encryption kill chain — catching it here prevents the ransomware event entirely.
• Audit PsExec-class service creation fleet-wide (Event IDs 7045/4697) and disable PsExec where not operationally required.
• Flag any UltraViewer installations for immediate user contact — tech-support scam victims are frequently mid-fraud when the RMM is found.

24 Hours

• Credential and session review for any host with a Gentlemen hash, UltraViewer install, or TDS DNS hit: force password resets, revoke tokens, and review mailbox/SSO sign-in logs. Double-extortion groups exfiltrate before encrypting — assume data exposure if any encryptor artifact is confirmed.
• Retro-hunt proxy/DNS logs 90 days for DPRK infrastructure contact; any confirmed .net.kp or silibank.com session escalates to incident response and legal review for sanctions exposure.
• Tor egress audit: any endpoint attempting .onion resolution or running Tor processes post-encryption-event indicates active ransom negotiation and must be preserved as evidence.

1 Week

• Driver load hardening: enable Microsoft Vulnerable Driver Blocklist (WDAC/ASR) and audit existing third-party driver inventory — CVE-2025-70795-style BYOVD attacks are defeated at policy level, not hash level.
• RMM governance: implement an allowlist for remote access tools (block all except sanctioned products); UltraViewer, AnyDesk-class abuse is the monetization step for TDS-driven scams.
• Predictive DNS: deploy registration-pattern/newly-registered-domain blocking to counter disposable TDS domains; reactive feeds will always lag Hotejka-style churn.
• Network segmentation review for manufacturing/healthcare/finance verticals named as Gentlemen targets: restrict SMB/ADMIN$ between workstation VLANs to blunt PsExec mass deployment.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub