THEGENTLEMEN Ransomware Gang: Multi-Sector Global Campaign & Critical CVE Exploitation Analysis

---
name: Potential THEGENTLEMEN Initial Access via Check Point Security Gateway
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects potential initial access activity related to CVE-2026-50751 exploitation on Check Point Security Gateways. THEGENTLEMEN has been actively exploiting this vulnerability for initial access.
author: Security Arsenal Research
date: 2026/06/16
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.50751
  - thegentlemen
logsource:
  product: firewall
  service: check_point
detection:
  selection:
    product|contains: 'Security Gateway'
    action|re: '(accept|decrypt)'
    service|re: '(ike|vpn|ipsec)'
  filter_legit:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate remote access from new corporate locations
  - New partner VPN connections
level: high
---
name: Potential THEGENTLEMEN Lateral Movement via Cobalt Strike
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
description: Detects potential Cobalt Strike beacon activity characteristic of THEGENTLEMEN lateral movement operations.
author: Security Arsenal Research
date: 2026/06/16
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.s0050
  - thegentlemen
logsource:
  product: windows
  service: security
detection:
  selection_process:
    EventID: 4688
    NewProcessName|contains:
      - 'powershell.exe'
      - 'rundll32.exe'
      - 'regsvr32.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'Invoke-Expression'
  selection_network:
    EventID: 5156
    DestPort: 443
    DestIp|re: '.*\.onion$'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative scripts
  - Authorized security tools
level: high
---
name: THEGENTLEMEN Pre-Encryption Data Staging Activity
id: c3d4e5f6-a7b8-9012-cdef-123456789012
description: Detects data staging patterns typically observed before THEGENTLEMEN encryption, including mass file copying and archive creation.
author: Security Arsenal Research
date: 2026/06/16
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
status: experimental
tags:
  - attack.exfiltration
  - attack.t1041
  - thegentlemen
logsource:
  product: windows
  service: security
detection:
  selection_archive:
    EventID: 4663
    ObjectType|contains:
      - 'File'
    ObjectName|contains:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.tar'
    AccessMask|contains:
      - '0x1'
      - '0x2'
      - '0x4'
  selection_masscopy:
    EventID: 4656
    ObjectType|contains:
      - 'File'
    ObjectName|re: '.*\\(Users|Documents|Shares|Backups)\\.*'
    AccessMask|contains:
      - '0x1'
      - '0x2'
  timeframe: 1h
  condition: selection_archive and selection_masscopy
falsepositives:
  - Legitimate backup operations
  - System administrators archiving files
level: high

// Hunt for potential THEGENTLEMEN lateral movement and staging activities
// Identify suspicious SMB connections and mass file access patterns
let TimeFrame = ago(7d);
let HighRiskProcesses = dynamic(['powershell.exe', 'cmd.exe', 'wmiexec.exe', 'psexec.exe', 'psexec64.exe']);
let SuspiciousDestinations = dynamic(['*.onion', '*.ddns.net', '*.no-ip.*']);

// Detect unusual lateral movement via SMB
let SMBConnections =
    DeviceNetworkEvents
    | where Timestamp >= TimeFrame
    | where RemotePort in (445, 139)
    | where InitiatingProcessFileName in~ HighRiskProcesses
    | summarize Connections=count() by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
    | where Connections > 10;

// Detect mass file access patterns (potential staging)
let FileAccessPattern =
    DeviceFileEvents
    | where Timestamp >= TimeFrame
    | where ActionType in ('FileCreated', 'FileModified', 'FileAccessed')
    | summarize FileCount=count(), DistinctFolders=dcount(FolderPath) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
    | where FileCount > 100 and DistinctFolders > 5;

// Detect connections to suspicious infrastructure
let SuspiciousNetwork =
    DeviceNetworkEvents
    | where Timestamp >= TimeFrame
    | where RemoteUrl has_any (SuspiciousDestinations) or RemoteIP in (external_data(SuspiciousIPs))
    | summarize ConnectionCount=count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, bin(Timestamp, 1h);

// Identify potential PowerShell download activity
let PowerShellSuspicious =
    DeviceProcessEvents
    | where Timestamp >= TimeFrame
    | where ProcessVersionInfoOriginalFileName =~ 'powershell.exe'
    | where ProcessCommandLine has_any ('DownloadString', 'IEX', 'Invoke-Expression', 'WebClient', 'DownloadFile')
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;

// Combine all detections
union SMBConnections, FileAccessPattern, SuspiciousNetwork, PowerShellSuspicious
| sort by Timestamp desc

<#
.SYNOPSIS
    THEGENTLEMEN Ransomware Rapid Response Script
.DESCRIPTION
    This script performs checks for indicators of THEGENTLEMEN ransomware activity and implements immediate hardening measures.
.NOTES
    File Name      : THEGENTLEMEN_Response.ps1
    Author         : Security Arsenal
    Prerequisite   : PowerShell 5.1 or later
    Execution Policy: Requires Administrator privileges
#>

param(
    [switch]$Detailed,
    [switch]$ApplyHardening
)

function Write-Log {
    param([string]$Message, [string]$Level='INFO')
    $timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    Write-Host "[$timestamp] [$Level] $Message"
}

Write-Log "Starting THEGENTLEMEN Ransomware Rapid Response Checks"

# Check for exposed RDP connections
Write-Log "Checking for active RDP connections..."
$rdpConnections = query user 2>&1
if ($rdpConnections -like "*Active*" -or $rdpConnections -like "*Disc*" ) {
    Write-Log "Active RDP sessions detected:" "WARNING"
    $rdpConnections
}

# Check for recently created suspicious scheduled tasks
Write-Log "Checking for suspicious scheduled tasks created in last 7 days..."
$cutoffDate = (Get-Date).AddDays(-7)
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Date -gt $cutoffDate -and 
    ($_.TaskName -match '\d{4}' -or $_.TaskName -match 'update' -or $_.TaskName -match 'system') -and 
    $_.Author -notlike '*Microsoft*' -and 
    $_.Author -notlike '*System*' 
}

if ($suspiciousTasks) {
    Write-Log "Suspicious scheduled tasks detected:" "WARNING"
    $suspiciousTasks | Format-Table TaskName, Author, Date, State -AutoSize
}

# Check for recently modified Volume Shadow Copies
Write-Log "Checking for Volume Shadow Copy manipulation..."
$vssChanges = vssadmin list shadows 2>&1 | Select-String "Creation Time"
if ($vssChanges) {
    $shadowCopies = $vssChanges | ForEach-Object {
        if ($_ -match "Creation Time: (\d{4}/\d{2}/\d{2})") {
            $dateStr = $Matches[1]
            $date = [datetime]::ParseExact($dateStr, "yyyy/MM/dd", [System.Globalization.CultureInfo]::InvariantCulture)
            if ($date -gt $cutoffDate) {
                $_
            }
        }
    }
    if ($shadowCopies) {
        Write-Log "Recent Volume Shadow Copy activity detected:" "WARNING"
        $shadowCopies
    }
}

# Check for mass file encryption indicators
Write-Log "Checking for indicators of mass file encryption..."
$fileExtensions = @('.encrypted', '.locked', '.thegentlemen', '.gent', '.enc')
$encryptedFiles = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $fileExtensions -contains $_.Extension } | 
    Select-Object -First 10 FullName, LastWriteTime

if ($encryptedFiles) {
    Write-Log "Potential encrypted files detected:" "CRITICAL"
    $encryptedFiles | Format-Table -AutoSize
}

# Check for unusual network connections
Write-Log "Checking for suspicious network connections..."
$netstat = netstat -ano | Select-String -Pattern 'ESTABLISHED'
$suspiciousPorts = @(4433, 4444, 5555, 6666, 8888, 9999)
$suspiciousConnections = $netstat | Where-Object { 
    $_ -match ":(443|80|4433|4444|5555|6666|8888|9999)\s" -and 
    $_ -notmatch "127\.0\.0\.1" -and
    $_ -notmatch "192\.168\." -and
    $_ -notmatch "10\." -and
    $_ -notmatch "172\.(1[6-9]|2[0-9]|3[0-1])\."
}

if ($suspiciousConnections) {
    Write-Log "Suspicious network connections detected:" "WARNING"
    $suspiciousConnections
}

# Apply hardening if requested
if ($ApplyHardening) {
    Write-Log "Applying immediate hardening measures..."
    
    # Disable RDP if not needed
    Write-Log "Disabling RDP if enabled..."
    $rdpStatus = (Get-WmiObject -class "Win32_TerminalServiceSetting" -Namespace root\cimv2\terminalservices).AllowTSConnections
    if ($rdpStatus -eq 1) {
        Write-Log "RDP is currently enabled. Disabling..." "WARNING"
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
        netsh advfirewall firewall set rule group="remote desktop" new enable=No
        Write-Log "RDP has been disabled."
    } else {
        Write-Log "RDP is already disabled."
    }
    
    # Block SMBv1
    Write-Log "Disabling SMBv1 if enabled..."
    $smb1Status = (Get-SmbServerConfiguration).EnableSMB1Protocol
    if ($smb1Status) {
        Write-Log "SMBv1 is enabled. Disabling..." "WARNING"
        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
        Write-Log "SMBv1 has been disabled."
    } else {
        Write-Log "SMBv1 is already disabled."
    }
    
    # Enable PowerShell script block logging
    Write-Log "Enabling PowerShell script block logging..."
    if (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging")) {
        New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force
    }
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
    Write-Log "PowerShell script block logging enabled."
    
    Write-Log "Hardening measures applied successfully."
}

Write-Log "THEGENTLEMEN Ransomware Rapid Response Checks completed."
if ($Detailed) {
    Write-Log "For detailed analysis, review full system logs and consider engaging Security Arsenal Incident Response team." "INFO"
}