THEGENTLEMEN Ransomware Gang: 24 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: Potential THEGENTLEMEN Ransomware - Check Point Gateway Exploitation
id: 8f9d3c2a-1b4e-5f6a-9c8d-0e1f2a3b4c5d
description: Detects potential exploitation attempts of Check Point Security Gateway vulnerability CVE-2026-50751 associated with THEGENTLEMEN ransomware activity
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: firewall
    service: checkpoint
detection:
    selection:
        EventID|contains: 
            - "auth_failure"
            - "ike_failure"
        src_ip|startswith: '192.168.'
    condition: selection
falsepositives:
    - Legitimate IKEv1 reconnection attempts from internal networks
level: high

---
title: THEGENTLEMEN Ransomware - ScreenConnect Suspicious Activity
id: 9a0e1b2c-3d4f-5a6b-7c8d-9e0f1a2b3c4d
description: Detects suspicious remote code execution via ConnectWise ScreenConnect associated with CVE-2024-1708 exploitation by THEGENTLEMEN
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.execution
    - attack.t1059
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|contains: 'ScreenConnect'
        CommandLine|contains:
            - 'PowerShell'
            - 'cmd.exe'
            - 'regsvr32'
            - 'rundll32'
    condition: selection
falsepositives:
    - Legitimate ScreenConnect administration tasks
level: high

---
title: THEGENTLEMEN Ransomware - Exchange Deserialization Attack
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects potential exploitation of Microsoft Exchange Server CVE-2023-21529 deserialization vulnerability used by THEGENTLEMEN
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: windows
    service: exchange
detection:
    selection:
        EventID: 4662
        ObjectType|contains: 'MSExchange'
        AccessMask|contains: '0x80100000'
    condition: selection
falsepositives:
    - Legitimate Exchange administration activities
level: high

// Hunt for potential lateral movement indicators associated with THEGENTLEMEN ransomware
let Timeframe = 7d;
let SuspiciousCommands = datatable(Command:string)["powershell -enc", "cmd.exe /c", "rundll32.exe javascript", "wmiexec", "psexec"];
let SuspiciousExtensions = datatable(Extension:string)[".ps1", ".bat", ".cmd", ".vbs", ".js"];
let SuspiciousParentProcesses = datatable(Process:string)["powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe"];
// Process creation with suspicious commands
DeviceProcessEvents
| where Timestamp >= ago(Timeframe)
| where ProcessCommandLine has_any (SuspiciousCommands) or 
    ProcessVersionInfoOriginalFileName in~ (SuspiciousExtensions) or 
    InitiatingProcessFileName in~ (SuspiciousParentProcesses)
// Network connection anomalies
| union (
    DeviceNetworkEvents
    | where Timestamp >= ago(Timeframe)
    | where RemoteUrl in~ ("anonfiles.com", "mega.nz", "dropmefiles.com", "transfer.sh") or
        InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe") and
        RemotePort in (443, 80, 21, 22, 445, 3389)
)
| summarize count(), by DeviceName, Timestamp, InitiatingProcessAccountName, InitiatingProcessFileName, ProcessCommandLine
| order by Timestamp desc

# THEGENTLEMEN Ransomware Rapid Response Assessment
# Execute as Administrator

Write-Host "Starting THEGENTLEMEN ransomware rapid response assessment..." -ForegroundColor Cyan

# Check for exposed RDP
$RDPStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($RDPStatus -eq 0) {
    Write-Host "WARNING: RDP is exposed and enabled" -ForegroundColor Red
    Write-Host "Action required: Disable RDP if not essential" -ForegroundColor Yellow
} else {
    Write-Host "RDP is currently disabled - Good" -ForegroundColor Green
}

# Enumerate suspicious scheduled tasks added in last 7 days
Write-Host "`nChecking for recently added suspicious scheduled tasks..." -ForegroundColor Cyan
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -ge (Get-Date).AddDays(-7) }
if ($SuspiciousTasks) {
    Write-Host "Found $($SuspiciousTasks.Count) scheduled tasks created in the last 7 days:" -ForegroundColor Yellow
    $SuspiciousTasks | Select-Object TaskName, Author, Date | Format-Table -AutoSize
} else {
    Write-Host "No suspicious scheduled tasks found" -ForegroundColor Green
}

# Check for recently modified Volume Shadow Copies
Write-Host "`nChecking for recently modified Volume Shadow Copies..." -ForegroundColor Cyan
$vss = vssadmin list shadows
if ($vss -match "Shadow Copy Volume") {
    $RecentShadows = $vss | Select-String "Shadow Copy Volume" | ForEach-Object {
        if ($_ -match "(\d{2}/\d{2}/\d{4})") {
            $shadowDate = [DateTime]::ParseExact($matches[1], "MM/dd/yyyy", $null)
            if ($shadowDate -ge (Get-Date).AddDays(-7)) { $_ }
        }
    }
    if ($RecentShadows) {
        Write-Host "Found recent Volume Shadow Copy modifications:" -ForegroundColor Yellow
        $RecentShadows | ForEach-Object { Write-Host $_ }
    } else {
        Write-Host "No recent suspicious Volume Shadow Copy modifications" -ForegroundColor Green
    }
} else {
    Write-Host "No Volume Shadow Copies found" -ForegroundColor Yellow
}

# Check for signs of data exfiltration
Write-Host "`nChecking for large data transfers that could indicate exfiltration..." -ForegroundColor Cyan
$NetStats = Get-NetTCPConnection | Where-Object { $_.State -eq "ESTABLISHED" -and $_.RemotePort -in @(21, 22, 80, 443, 445) }
if ($NetStats) {
    Write-Host "Found active connections on ports commonly used for data exfiltration:" -ForegroundColor Yellow
    $NetStats | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Format-Table -AutoSize
} else {
    Write-Host "No suspicious active connections detected" -ForegroundColor Green
}

Write-Host "`nRapid response assessment complete" -ForegroundColor Cyan
Write-Host "If any issues were detected, initiate incident response procedures immediately" -ForegroundColor Yellow