THEGENTLEMEN Ransomware Gang: 5 New Victims in 72 Hours — Cross-Sector Campaign Targeting Defense, Finance & Critical Transport

Classification: TLP:CLEAR | Source: Dark web leak site monitoring via ransomware.live | Date: 2026-08-20

Security Arsenal's dark web monitoring has confirmed a burst of activity from the THEGENTLEMEN ransomware operation, with five victims posted to the group's .onion leak site between 2026-08-17 and 2026-08-19. The campaign shows no sector loyalty — defense contractors, transportation operators, and financial firms were hit within the same 72-hour window across five countries on three continents. This briefing translates that raw leak-site telemetry into detection content and response priorities for enterprise security teams.

Threat Actor Profile — THEGENTLEMEN

• Known aliases: THEGENTLEMEN, Gentlemen RaaS. The group brands itself with a 'professional services' aesthetic on its leak site, using formal language in victim announcements and negotiation portals — a psychological pressure tactic designed to make extortion feel like a business transaction.
• Operating model: Ransomware-as-a-Service (RaaS). Core operators maintain the encryptor, negotiation infrastructure, and leak site; affiliates execute intrusions. This explains the sector and geographic dispersion in the current victim set — multiple affiliates are likely working concurrent intrusions rather than a single coordinated campaign.
• Ransom demands: Observed demands scale with victim revenue, typically ranging from $250K for mid-market targets to $5M+ for defense and financial-sector victims. Demands are denominated in Monero (XMR) with a 72-hour initial deadline before the 'publication timer' starts.
• Initial access methods (observed across intrusions):
  • Exploitation of perimeter VPN and remote access appliances (consistent with the KEV-listed CVEs below — Check Point gateway and ScreenConnect exploitation feature prominently)
  • Phishing with macro-laden Office documents and malicious IDE/supply-chain tooling (aligns with the Nx Console malicious code CVE)
  • Exposed RDP brute-forcing followed by privilege escalation via Windows link-following flaws
  • Valid accounts purchased from initial access brokers (IABs)
• Extortion model: Double extortion. Data is staged and exfiltrated before encryption detonates. Victims who restore from backup without paying are still threatened with leak-site publication — which is exactly what the five postings below represent.
• Average dwell time: 5–14 days from initial access to detonation, with exfiltration typically occurring in the final 48–72 hours. This dwell window is the defender's opportunity — every detection below is built for the pre-encryption phase.

Current Campaign Analysis

Victims Posted (2026-08-17 → 2026-08-19)

Sector Targeting

The victim set is deliberately diversified: defense/aerospace (Babcock — a high-sensitivity target given defense supply chain implications), transportation infrastructure (Roadvision Systems), financial services (Senvest Capital), and technology (Euroscreen). This is classic multi-affiliate RaaS dispersion, not a focused vertical campaign. However, the inclusion of a Government & Defense victim elevates the risk tier: organizations in the defense industrial base should assume they are in-scope for follow-on targeting, as leak-site visibility of a successful defense-sector breach historically attracts copycat affiliates within 2–3 weeks.

Geographic Concentration

No concentration — ZA, SE, CA, GB, IT across five victims. This spread (Africa, Northern Europe, North America, Western Europe, Southern Europe) strongly suggests opportunistic targeting driven by exploit availability rather than geopolitical intent. Affiliates scan for vulnerable edge devices globally and hit what responds.

Victim Profile

Estimated revenue range: $20M–$1B+. Babcock sits at the large-enterprise end (defense contractor scale); Senvest Capital and Euroscreen represent mid-market targets — the RaaS sweet spot where organizations hold valuable data but often lack 24/7 SOC coverage. Three of the five victims fall in the mid-market band, consistent with affiliate preference for soft targets with real payment capacity.

Posting Frequency & Escalation

Five postings in 72 hours with three on a single day (2026-08-18) indicates either a batch publication after a quiet negotiation period or multiple affiliates concluding negotiations simultaneously. Watch for a second wave within 7–10 days — batch publications frequently precede a second tranche as the group leverages publicity momentum.

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries (all confirmed ransomware-associated) map directly to THEGENTLEMEN's known access playbook:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange): Prime candidate for the initial foothold across this victim set. Edge VPN exploitation fits the geographic scatter pattern. Any organization running Check Point gateways with IKEv1 enabled should treat this as the highest-priority patch action this week.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE: Favored by affiliates targeting MSPs and mid-market victims (matches the Senvest/Euroscreen profile).
• CVE-2026-48027 — Nx Console embedded malicious code: Supply-chain/developer-workstation vector; relevant for the technology-sector victim (Euroscreen).
• CVE-2025-60710 — Windows link following (privilege escalation) and CVE-2023-21529 — Exchange deserialization: Post-access escalation vectors used to move from a single compromised host to domain dominance before staging.

Assessment (moderate confidence): The intrusions behind this week's postings likely began 5–14 days ago via edge-device exploitation, with the Check Point and ScreenConnect CVEs as the most probable entry points.

Detection Engineering

The Sigma rules below target the three phases THEGENTLEMEN affiliates reliably execute: (1) macro/phishing execution and VPN-edge post-exploitation, (2) lateral movement via PsExec/WMI, and (3) data staging and shadow copy destruction before encryption. Tune to your environment before production deployment.

---
title: THEGENTLEMEN - Office Macro Spawning Script Interpreter (Phishing Initial Access)
id: 8f3a2b1c-7d4e-4a1b-9c2d-thegentle01
status: experimental
description: Detects Microsoft Office applications spawning script interpreters or download cradles, consistent with THEGENTLEMEN phishing macro execution TTPs.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_known:
    CommandLine|contains:
      - 'OfficeClickToRun'
  condition: selection_parent and selection_child and not filter_known
falsepositives:
  - Rare legitimate Office add-in automation
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
---
title: THEGENTLEMEN - PsExec or WMI Remote Service Execution (Lateral Movement)
id: 8f3a2b1c-7d4e-4a1b-9c2d-thegentle02
status: experimental
description: Detects PsExec-style service installation or WMI remote process creation, used by THEGENTLEMEN affiliates for lateral movement prior to ransomware deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_wmi:
    ParentImage|endswith: '\wmiprvse.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  selection_svc:
    - EventID: 7045
    - ServiceFileName|contains:
        - 'ADMIN$'
        - '\\127.0.0.1\\'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) — whitelist known admin hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: THEGENTLEMEN - Pre-Encryption Staging - Shadow Copy Deletion and Exfil Archive Creation
id: 8f3a2b1c-7d4e-4a1b-9c2d-thegentle03
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic and mass archive creation with 7z/rar — the final pre-detonation signature of THEGENTLEMEN intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
  condition: selection_vss or selection_bcd or selection_archive
falsepositives:
  - Backup software and IT archive operations — baseline and exclude known backup service accounts
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1486

The following Microsoft Sentinel KQL query hunts the full pre-ransomware staging chain: suspicious archive tool execution followed by high-volume outbound transfer from the same host within 4 hours — the exfiltration-before-encryption pattern THEGENTLEMEN relies on for double extortion.

// THEGENTLEMEN pre-ransomware staging hunt: archive creation + outbound exfil correlation
// Lookback: 7 days | MITRE: T1560.001, T1041, T1020
let lookback = 7d;
let staging_hosts =
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe")
   or (ProcessCommandLine has_any (" a "," -p"," -m5") and FileName endswith ".exe")
| where ProcessCommandLine !has_any ("\\Program Files\\Backup","Veeam","Commvault") // tune to your backup stack
| summarize FirstArchive=min(TimeGenerated), ArchiveCmds=make_set(ProcessCommandLine, 5) by DeviceId, DeviceName, InitiatingProcessAccountName;
staging_hosts
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(lookback)
    | where ActionType == "ConnectionSuccess"
    | where RemoteIPType == "Public"
    | where RemotePort in (443, 22, 21, 990, 8443) or RemoteUrl has_any ("mega.nz","file.io","transfer.sh","anonfiles","gofile")
    | summarize OutboundConnections=count(), FirstTransfer=min(TimeGenerated), Destinations=make_set(RemoteUrl, 10) by DeviceId
) on DeviceId
| where FirstTransfer >= FirstArchive and datetime_diff("hour", FirstTransfer, FirstArchive) <= 4
| project DeviceName, InitiatingProcessAccountName, FirstArchive, FirstTransfer, OutboundConnections, Destinations, ArchiveCmds
| sort by FirstArchive asc

The PowerShell script below is a rapid-response triage tool: run it on any suspected host to check for newly created scheduled tasks (persistence), shadow copy tampering, suspicious archive tooling, and RDP exposure — the four fastest signals of an in-progress THEGENTLEMEN intrusion.

# THEGENTLEMEN Rapid Triage Script — Security Arsenal (2026-08-20)
# Run elevated on suspected hosts. Outputs to console + C:\IR\triage-<hostname>-<date>.txt
$out = "C:\IR\triage-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').txt"
New-Item -Path 'C:\IR' -ItemType Directory -Force | Out-Null
Start-Transcript -Path $out -Force

Write-Host '=== [1] Scheduled tasks created/modified in last 7 days (persistence) ==='
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; LastRun=$info.LastRunTime; Author=$_.Author; Action=($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; ' }
} | Where-Object { $_.Action -match 'powershell|cmd|rundll32|mshta|wscript|AppData|Temp' } | Format-List

Write-Host '=== [2] Volume Shadow Copy status (pre-encryption tampering check) ==='
vssadmin list shadows 2>&1
Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
Write-Host '--- Recent vssadmin/bcdedit/wmic execution artifacts (Prefetch) ---'
Get-ChildItem "$env:SystemRoot\Prefetch" -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'VSSADMIN|BCDEDIT|WMIC' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object Name, LastWriteTime

Write-Host '=== [3] Archive/exfil tooling artifacts (7z/rar in last 7 days) ==='
Get-ChildItem "$env:SystemRoot\Prefetch" -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '7Z|RAR|WINRAR|MEGA|RCLONE' -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object Name, LastWriteTime
Get-ChildItem 'C:\Users\*\Downloads','C:\Users\*\Desktop','C:\ProgramData' -Recurse -Include *.7z,*.rar -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 50MB } | Select-Object FullName, Length, LastWriteTime

Write-Host '=== [4] RDP exposure & recent logons (initial access check) ==='
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
Write-Host ("RDP Enabled: " + $(if ($rdp.fDenyTSConnections -eq 0) {'YES - EXPOSED'} else {'No'}))
Write-Host ("NLA Required: " + (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } | Group-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' | Select-Object -Expand '#text' } |
    Sort-Object Count -Descending | Select-Object -First 10 Name, Count | Format-Table -AutoSize

Write-Host '=== [5] Suspicious services installed in last 7 days (PsExec-style) ==='
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message | Format-List

Stop-Transcript
Write-Host "`nTriage complete. Output: $out`nIf sections 2 or 3 show unexpected artifacts: ISOLATE HOST NOW and invoke IR retainer."

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. Shadow copy deletion (vssadmin delete shadows, bcdedit ... recoveryenabled no) — the single highest-fidelity pre-detonation signal. Any occurrence outside backup windows = isolate immediately.
2. Mass archive creation — 7z/rar archives >50MB appearing in user profiles or ProgramData, especially with password flags (-p).
3. New admin-level accounts or group membership changes outside change control, particularly on Domain Controllers and backup infrastructure.
4. PsExec/WMI service artifacts (Event ID 7045 with ADMIN$ paths) on hosts that don't normally receive remote administration.
5. Anomalous outbound volume to consumer file-sharing or cloud storage from servers (not workstations) — THEGENTLEMEN exfiltrates in the final 48–72 hours.
6. AV/EDR tampering — defensive product services stopping or exclusions being added en masse.

Critical Assets This Gang Prioritizes for Exfiltration

• Defense-sector victims: contract documents, technical drawings, export-controlled data (ITAR/EAR relevance raises regulatory exposure dramatically)
• Financial-sector victims: client PII, portfolio/trading data, M&A documents
• All victims: HR records, executive mailbox exports, legal privilege documents, and — critically — insurance policy documents (used to calibrate ransom demands to coverage limits)
• Backup catalogs and credential stores are targeted for destruction, not exfiltration, to eliminate the no-pay recovery option

Containment Actions — Ordered by Urgency

1. Isolate affected hosts from the network (EDR network isolation, not just reboot) — leave powered on for forensic capture.
2. Disable compromised accounts and force enterprise-wide credential resets for any account that touched a compromised host — assume lsass was dumped.
3. Block exfiltration egress at the perimeter (consumer file-sharing domains, unknown cloud storage, non-standard ports from server VLANs).
4. Snapshot and protect backups immediately — take backup infrastructure offline or into immutable/air-gapped mode before the operator finds it.
5. Preserve volatile evidence: memory capture, Prefetch, USN Journal, $MFT, VPN/firewall logs for the 14-day dwell window.
6. Check the leak site (or have your IR retainer/monitoring service do it) — if the victim name appears, the data is already gone; shift priorities to legal, regulatory, and communications workstreams.
7. Engage counsel before any negotiation contact — defense-sector victims must evaluate export-control and government disclosure obligations immediately.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point gateway IKEv1 improper auth). If patching is not possible today, disable IKEv1 key exchange and restrict gateway management interfaces. This is the probable entry vector for this week's victim set.
• Patch CVE-2024-1708 (ScreenConnect) on all remote support infrastructure; audit for rogue ScreenConnect instances and uninstall unauthorized remote access tools enterprise-wide.
• Apply CVE-2025-60710 and CVE-2023-21529 patches (Windows link following, Exchange deserialization) to close the escalation path from initial foothold to domain dominance.
• Disable Office macros from the internet via Group Policy (Mark of the Web enforcement) and block child processes of Office applications via Attack Surface Reduction rules.
• Audit RDP exposure: nothing on 3389 to the internet — enforce VPN+MFA or remove. Verify NLA is enabled.
• Deploy the Sigma rules above in detection-only mode and run the KQL hunt across the last 14 days of telemetry.

Short-Term (2 Weeks)

• Segment server VLANs from workstation egress — servers should have no path to consumer file-sharing/cloud storage. Exfiltration should be architecturally impossible, not just alerting.
• Implement immutable, air-gapped backups (WORM storage or offline copies) with restore testing. THEGENTLEMEN's playbook specifically targets recoverability to force payment.
• Deploy application control (WDAC/AppLocker) blocking unauthorized archive utilities and script interpreters on servers.
• Roll out phishing-resistant MFA (FIDO2/passkeys) on all remote access, email, and administrative interfaces — valid-account abuse is a core affiliate TTP.
• Enable tamper protection and isolation of EDR on all endpoints; alert on any defensive-product modification.
• Stand up dark web leak-site monitoring for your organization, subsidiaries, and critical suppliers — dwell time means you may get warning before detonation if your name appears in a 'coming soon' listing.

Analyst's Bottom Line

THEGENTLEMEN's 72-hour, five-victim burst is opportunistic RaaS at industrial scale — but the dwell-time window and the gang's heavy dependence on known-exploited edge vulnerabilities mean this campaign is highly detectable and highly preventable. Organizations running Check Point gateways, ScreenConnect, or internet-facing RDP should treat this as a patch-and-hunt action this week, not a roadmap item. The encryption event is the last mile of a two-week intrusion; the Sigma, KQL, and triage content above is built to catch it in the first ten days.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub