THEGENTLEMEN Ransomware Gang: 15 Victims Posted in 48 Hours — Multi-Sector Campaign Analysis, CVE Correlation & Detection Engineering

---
title: THEGENTLEMEN - Shadow Copy Deletion Pre-Ransomware
id: 8f3a1c2e-tg01-4b7a-9c1d-2026tg0001
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin, wmic, or PowerShell — a hallmark pre-encryption step observed in THEGENTLEMEN intrusions. Dwell time is short; this often fires hours before detonation.
author: Security Arsenal Threat Intel
date: 2026/09/16
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: critical
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance scripts (rare outside maintenance windows)
  - IT administrators performing storage reclamation
---
title: THEGENTLEMEN - PsExec and WMI Lateral Movement Execution
id: 8f3a1c2e-tg01-4b7a-9c1d-2026tg0002
status: experimental
description: Identifies service-based lateral movement consistent with THEGENTLEMEN affiliate tooling — PsExec-style service creation, remote WMI process spawn, and ADMIN$ writes following edge-device or RDP initial access.
author: Security Arsenal Threat Intel
date: 2026/09/16
logsource:
  product: windows
  service: system
level: high
detection:
  selection_eventid:
    EventID: 7045
  selection_svc:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'paexec'
      - 'remcom'
      - 'csexec'
    ServiceFileName|contains:
      - '\ADMIN$\'
      - '\Temp\'
      - '\Users\Public\'
  condition: selection_eventid and selection_svc
falsepositives:
  - Legitimate remote administration by IT (whitelist known admin hosts)
  - SCCM/Intune software deployment (distinct service names)
---
title: THEGENTLEMEN - Pre-Exfiltration Archive Staging on File Servers
id: 8f3a1c2e-tg01-4b7a-9c1d-2026tg0003
status: experimental
description: Detects mass archive creation via 7z/rar/WinRAR from command line on servers — THEGENTLEMEN affiliates stage compressed data for exfiltration via Rclone/MEGA before encryption. Double extortion makes this the highest-value pre-impact signal.
author: Security Arsenal Threat Intel
date: 2026/09/16
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - '-p'
      - '.7z'
      - '.rar'
  selection_host:
    - Computer|contains: 'SRV'
    - Computer|contains: 'FS'
    - Computer|contains: 'DC'
  filter_tools:
    CommandLine|contains:
      - 'BackupExec'
      - 'Veeam'
  condition: (selection_img and selection_cmd and selection_host) and not filter_tools
falsepositives:
  - Legitimate scheduled compression jobs (baseline and exclude known task accounts)

// THEGENTLEMEN pre-ransomware staging correlation — 6h window per device
// Hunt window recommendation: last 14 days, then convert to scheduled analytics rule
let Window = 6h;
let ArchiveTools = dynamic(["7z.exe","7za.exe","rar.exe","winrar.exe","rclone.exe","megacmd.exe","filezilla.exe"]);
let SuspectLogons =
    SecurityEvent
    | where TimeGenerated > ago(14d)
    | where EventID == 4624 and LogonType in (3, 10)  // network + RDP
    | where Account !startswith "ANONYMOUS" and Account !endswith "$"
    | summarize FirstLogon=min(TimeGenerated) by Computer, Account, IpAddress;
let AdminShareWrites =
    SecurityEvent
    | where TimeGenerated > ago(14d)
    | where EventID == 5145
    | where Share_Name has "ADMIN$" or Share_Name has "C$"
    | summarize AdminWrites=count(), FirstWrite=min(TimeGenerated) by Computer, Account;
let StagingProcs =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName in~ (ArchiveTools)
       or ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "wbadmin delete")
    | summarize StagingEvents=count(), FirstStaging=min(TimeGenerated),
                CmdLines=make_set(ProcessCommandLine, 10) by DeviceName, InitiatingProcessAccountName;
let MassFileAccess =
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where ActionType == "FileRenamed" and FileName matches regex @"(?i)\.(locked|gentlemen|enc|crypt\d*)$"
    | summarize Renames=count(), FirstRename=min(TimeGenerated) by DeviceName;
SuspectLogons
| join kind=inner AdminShareWrites on Computer, Account
| join kind=inner (StagingProcs | project DeviceName, InitiatingProcessAccountName, StagingEvents, FirstStaging, CmdLines)
    on $left.Computer == $right.DeviceName and $left.Account == $right.InitiatingProcessAccountName
| join kind=leftouter MassFileAccess on $left.Computer == $right.DeviceName
| where FirstStaging between (FirstLogon .. (FirstLogon + Window))
| project Computer, Account, IpAddress, FirstLogon, AdminWrites, StagingEvents, CmdLines,
          EncryptionStarted=Renames, FirstRename
| order by FirstLogon asc;

# THEGENTLEMEN Rapid Triage — persistence, exposure, and pre-encryption artifacts
# Run elevated. Output written to C:\IR_Triage\TG_sweep_<hostname>_<timestamp>.txt
$out = "C:\IR_Triage"
New-Item -ItemType Directory -Path $out -Force | Out-Null
$report = Join-Path $out ("TG_sweep_{0}_{1:yyyyMMdd_HHmm}.txt" -f $env:COMPUTERNAME, (Get-Date))

"=== THEGENTLEMEN Rapid Triage: $env:COMPUTERNAME ===" | Out-File $report

"`n[1] RDP Exposure (port 3389 listeners + NLA status)" | Out-File $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
    Format-Table LocalAddress, LocalPort, OwningProcess -AutoSize | Out-File $report -Append
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication |
    ForEach-Object { "NLA Enabled: $_ (0 = DISABLED = HIGH RISK)" } | Out-File $report -Append

"`n[2] Scheduled Tasks created in last 7 days (persistence check)" | Out-File $report -Append
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_ -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$info.LastRunTime; Author=$_.Author }
} | Where-Object { $_.Author -and $_.Author -notmatch 'Microsoft' } |
  Sort-Object LastRun -Descending | Format-Table -AutoSize | Out-File $report -Append

"`n[3] Shadow Copies (should NOT be empty on servers)" | Out-File $report -Append
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: No shadow copies found — possible pre-encryption deletion" | Out-File $report -Append }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize | Out-File $report -Append }

"`n[4] Suspicious archive/exfil tooling processes and recent installs" | Out-File $report -Append
Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '7z|rar|rclone|mega|filezilla|psexec|winscp' } |
    Select-Object Name, Id, Path, StartTime | Format-Table -AutoSize | Out-File $report -Append
Get-ChildItem "C:\Users\Public", "C:\ProgramData" -Recurse -Depth 2 -Include *.7z,*.rar,*.zip `
    -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize | Out-File $report -Append

"`n[5] New local admin accounts (last 14 days)" | Out-File $report -Append
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize | Out-File $report -Append

"`n[6] Recently failed logons (RDP brute-force indicator)" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-3)} `
    -MaxEvents 500 -ErrorAction SilentlyContinue |
    Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending |
    Select-Object -First 10 Count, Name | Format-Table -AutoSize | Out-File $report -Append

"`nTriage complete: $report"