THEGENTLEMEN Ransomware Gang: 15 New Single-Source Listings Across 8 Countries — Sector Targeting Analysis & Detection Engineering

---
title: THEGENTLEMEN - Suspicious RDP Brute Force Followed by Successful Authentication
id: 8f4a2b1c-9d3e-4f5a-b6c7-1a2b3c4d5e6f
status: experimental
description: Detects RDP brute force patterns followed by successful logon, consistent with THEGENTLEMEN initial access tradecraft
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.initial_access
    - attack.t1110
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection_failed:
        EventID: 4625
        LogonType: 10
        FailureReason: '%%2313'
    selection_success:
        EventID: 4624
        LogonType: 10
    condition: selection_failed | count() by SourceAddress > 10
    timeframe: 5m
    condition2: selection_success and selection_failed
level: high
---
title: THEGENTLEMEN - PsExec or WMI Lateral Movement with Cobalt Strike Indicators
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects lateral movement via PsExec service creation or WMI process execution with command lines consistent with Cobalt Strike beacon deployment
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1059
logsource:
    product: windows
    service: security
detection:
    selection_psexec:
        EventID: 7045
        ServiceName|contains:
            - 'PSEXESVC'
            - 'psexesvc'
    selection_wmi:
        EventID: 4688
        ParentImage|endswith: '\wmiprvse.exe'
        NewProcessName|contains:
            - 'powershell'
            - 'cmd'
            - 'rundll32'
    selection_cobalt:
        EventID: 4688
        CommandLine|contains:
            - 'rundll32.exe'
            - 'regsvr32.exe'
            - 'mshta.exe'
            - '.dll,'
    condition: selection_psexec or selection_wmi or selection_cobalt
falsepositives:
    - Administrative activity
    - Legitimate software deployment
level: high
---
title: THEGENTLEMEN - Data Staging and Shadow Copy Deletion Pre-Ransomware
id: 7d8e9f0a-1b2c-3d4e-5f6a-7b8c9d0e1f2a
status: experimental
description: Detects volume shadow copy deletion and suspicious archive creation activity associated with THEGENTLEMEN pre-encryption staging
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Threat Intelligence
date: 2026/11/12
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.collection
logsource:
    product: windows
    service: security
detection:
    selection_vss:
        EventID: 4688
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'vssadmin Delete Shadows'
            - 'wmic shadowcopy delete'
            - 'diskshadow'
    selection_archive:
        EventID: 4688
        CommandLine|contains:
            - '7z a'
            - 'rar a'
            - 'winrar a'
            - 'tar -czf'
    selection_network:
        EventID: 4688
        CommandLine|contains:
            - 'net use'
            - 'robocopy'
            - 'xcopy'
    condition: selection_vss or (selection_archive and selection_network)
level: critical

// THEGENTLEMEN Pre-Ransomware Staging & Lateral Movement Hunt
// Run across 7-day window for dwell time alignment
let TimeWindow = 7d;
let SuspiciousProcesses = dynamic(["psexec", "wmic", "powershell", "rundll32", "regsvr32", "mshta", "vssadmin", "7z", "rar"]);

// Stage 1: Identify potential lateral movement sources
let LateralMovementSources = SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where EventID == 4688
| where Process has_any (SuspiciousProcesses)
| where CommandLine has_any ("\\", "admin$", "c$", "ipc$")
| summarize LateralCommands = make_set(CommandLine), CommandCount = count() by Computer, Account, bin(TimeGenerated, 1h)
| where CommandCount > 3;

// Stage 2: Shadow copy deletion and archive creation on same hosts
let StagingHosts = SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where EventID == 4688
| where CommandLine has_any ("vssadmin delete", "shadowcopy delete", "7z a", "rar a")
| summarize StagingCommands = make_set(CommandLine) by Computer, Account;

// Stage 3: Correlate with network connections to external IPs
let ExternalConnections = DeviceNetworkEvents
| where TimeGenerated > ago(TimeWindow)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName has_any (SuspiciousProcesses)
| summarize ExternalIPs = make_set(RemoteIP), ConnectionCount = count() by DeviceName, InitiatingProcessAccountName;

// Final correlation
LateralMovementSources
| join kind=inner (StagingHosts) on Computer
| join kind=leftouter (ExternalConnections) on $left.Computer == $right.DeviceName
| project Computer, Account, LateralCommands, StagingCommands, ExternalIPs, TimeGenerated
| extend RiskScore = case(
    array_length(LateralCommands) > 5 and isnotempty(ExternalIPs), "CRITICAL",
    array_length(LateralCommands) > 3, "HIGH",
    "MEDIUM"
)
| order by RiskScore desc, TimeGenerated desc;

# THEGENTLEMEN Rapid Triage Script — Run on suspected compromised hosts
# Checks for: recent scheduled tasks, shadow copy status, RDP exposure, suspicious services

Write-Host "=== THEGENTLEMEN Rapid Response Triage ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss UTC')" -ForegroundColor Gray

# 1. Scheduled Tasks Created in Last 7 Days (persistence mechanism)
Write-Host "`n[1] Scheduled Tasks Created in Last 7 Days:" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Select-Object TaskName, TaskPath, Date, Author, State | 
    Format-Table -AutoSize

# 2. Volume Shadow Copy Status (ransomware precursor)
Write-Host "`n[2] Volume Shadow Copy Status:" -ForegroundColor Yellow
$Shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) {
    $Shadows | Select-Object DeviceObject, InstallDate, Count | Format-Table -AutoSize
    Write-Host "WARNING: Shadow copies exist — verify none were recently deleted" -ForegroundColor Red
} else {
    Write-Host "CRITICAL: No shadow copies found — may indicate pre-encryption cleanup" -ForegroundColor Red
}

# 3. Recent VSS Deletion Events
Write-Host "`n[3] Recent VSS/Shadow Copy Deletion Events (EventID 4688):" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -match 'vssadmin.*delete|wmic.*shadowcopy'} | 
    Select-Object TimeCreated, Message | 
    Format-List

# 4. Suspicious Services (PsExec, Cobalt Strike patterns)
Write-Host "`n[4] Recently Created or Suspicious Services:" -ForegroundColor Yellow
Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Running'} | 
    Where-Object {$_.Name -match 'psexesvc|mssecsvc|wuauserv|winmgmt' -or $_.DisplayName -match 'Windows Update|Security Center'} | 
    Select-Object Name, DisplayName, StartType, Status | 
    Format-Table -AutoSize

# 5. RDP Configuration & Recent Logons
Write-Host "`n[5] RDP Exposure Assessment:" -ForegroundColor Yellow
$RDPKey = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction SilentlyContinue
if ($RDPKey.fDenyTSConnections -eq 0) {
    Write-Host "RDP ENABLED — Check for unauthorized access" -ForegroundColor Red
    Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; LogonType=10; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue | 
        Select-Object TimeCreated, @{N='SourceIP';E={($_.Message -split '`n')[18] -replace '.*: '}}, @{N='Account';E={($_.Message -split '`n')[5] -replace '.*: '}} | 
        Format-Table -AutoSize
} else {
    Write-Host "RDP disabled at host level" -ForegroundColor Green
}

# 6. Network Connections to Known Cobalt Strike Ports
Write-Host "`n[6] Active Connections on Common C2 Ports:" -ForegroundColor Yellow
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Where-Object {$_.RemotePort -in @(80, 443, 8080, 8443, 53, 123, 50050)} | 
    Where-Object {$_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|0\.0\.0\.0)'} | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | 
    Format-Table -AutoSize

Write-Host "`n=== Triage Complete ===" -ForegroundColor Cyan
Write-Host "Review any CRITICAL or WARNING items immediately" -ForegroundColor Gray