THEGENTLEMEN Ransomware: Global Campaign Targets Tech & Healthcare — Detection Engineering

Date: 2026-04-21
Analyst: Security Arsenal Threat Intelligence Unit
Source: Dark Web Leak Site Telemetry (ransomware.live)

Threat Actor Profile — THEGENTLEMEN

THEGENTLEMEN have rapidly emerged as a prolific Ransomware-as-a-Service (RaaS) operation. Unlike affiliates who rely solely on widespread phishing, this group demonstrates a high level of technical sophistication, specifically targeting edge networking infrastructure and unpatched services for initial access.

• Model: RaaS with a centralized core development team and distributed affiliates.
• Ransom Demands: Estimated range $500,000 – $5,000,000 USD, adjusted based on victim revenue and encrypted volume.
• Initial Access: Heavily reliant on exploiting vulnerabilities in external-facing appliances (Cisco, Citrix, Fortinet) and Authentication Bypasses in mail services.
• Tactics: Aggressive double extortion. They exfiltrate sensitive corporate data (HR, R&D, Financials) prior to encryption and utilize a pressure campaign involving DDoS attacks on victim public-facing assets if negotiations stall.
• Dwell Time: Short. Analysis suggests an average of 3–5 days from initial vulnerability exploit to detonation.

Current Campaign Analysis

Sector & Geographic Targets

THEGENTLEMEN have posted 23 victims in their last 100 updates. The current campaign (2026-04-15 to 2026-04-19) shows a distinct pivot toward high-value sectors:

1. Technology & Business Services: 40% of recent victims (e.g., Teleos Systems, The Marton Agency).
2. Healthcare: 13% (e.g., Laboratório Santa Luzia, Greenpharma), indicating a willingness to target critical infrastructure despite legal risks.
3. Manufacturing & Logistics: 20% (e.g., Anderlues, Jumbo Transport).

Geographically, the group is opportunistic but shows high activity in the US, GB, and Western Europe (BE, PL, DK).

TTP Correlation & CVEs

The group's success is directly linked to the exploitation of CISA Known Exploited Vulnerabilities (KEV). Recent victimology correlates with the following initial access vectors:

• CVE-2026-20131 (Cisco Secure Firewall FMC): A critical deserialization flaw allowing unauthenticated RCE. Used to breach perimeter defenses and pivot into the internal network.
• CVE-2026-23760 (SmarterTools SmarterMail): An authentication bypass. THEGENTLEMEN leverage this to access email servers, harvest credentials, and move laterally.
• CVE-2025-5777 (Citrix NetScaler ADC): An out-of-bounds read vulnerability leading to sensitive information disclosure or potential RCE. Used to bypass VPN authentication controls.

Escalation Pattern

There is a sharp spike in posting activity on 2026-04-19 (8 victims posted simultaneously), suggesting a coordinated "blitz" tactic by multiple affiliates using the same exploit kit.

Detection Engineering

SIGMA Rules

---
title: Potential Citrix NetScaler ADC Exploitation CVE-2025-5777
id: 6b5f5d6c-1234-5678-9abc-1a2b3c4d5e6f
description: Detects potential exploitation of Citrix NetScaler ADC out-of-bounds read vulnerability leading to RCE or information disclosure.
author: Security Arsenal
status: experimental
date: 2026/04/21
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
detection:
    selection:
        c-uri|contains:
            - '/vpn/servlet'
            - '/nitro/v1/config'
        sc-status: 
            - 200
            - 500
    filter:
        cs-user-agent|contains:
            - 'Mozilla'
            - 'CitrixReceiver'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access via non-standard tools
level: critical
---
title: SmarterMail Authentication Bypass Attempt CVE-2026-23760
id: a1b2c3d4-5678-90ab-cdef-123456789abc
description: Detects potential authentication bypass on SmarterMail servers via alternate path or channel exploitation.
author: Security Arsenal
status: experimental
date: 2026/04/21
logsource:
    product: smtp
    service: postfix
detection:
    selection:
        |contains:
            - 'SmarterMail'
            - 'Authentication-Results'
    condition: selection
falsepositives:
    - Administrative testing
level: high
---
title: Suspicious Data Staging via Rclone
id: e5f6g7h8-9012-34cd-efab-567890abcdef
description: THEGENTLEMEN affiliates often use Rclone for data exfiltration to cloud storage prior to encryption.
author: Security Arsenal
status: experimental
date: 2026/04/21
logsource:
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
    selection_cli:
        CommandLine|contains:
            - 'config create'
            - 'copy'
            - 'sync'
            - 'mega:'
            - 'pcloud:'
    condition: all of selection_*
falsepositives:
    - Legitimate administrator backups
level: high

KQL (Microsoft Sentinel)

Hunt for lateral movement and web shell activity associated with THEGENTLEMEN's exploitation of edge devices.

let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Look for web server processes spawning shells (common webshell behavior)
| where InitiatingProcessFileName in ("w3wp.exe", "java.exe", "httpd.exe", "ns-httpd.exe", "nginx.exe") 
| where FileName in ("cmd.exe", "powershell.exe", "bash.exe", "pwsh.exe")
// Filter out legitimate administrative paths if known
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| extend FullPath = FolderPath 
| order by Timestamp desc

PowerShell Response Script

Rapid-response script to check for ransomware precursors: Scheduled Task creation and Shadow Copy manipulation.

# THEGENTLEMEN Ransomware Hardening Check
# Run as Administrator

Write-Host "Checking for Ransomware Indicators..." -ForegroundColor Cyan

# 1. Check for recently modified Scheduled Tasks (last 24 hours)
$suspiciousTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-24)}
if ($suspiciousTasks) {
    Write-Host "[ALERT] Tasks created/modified in last 24 hours:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Status
$vss = vssadmin list shadows
if ($vss -match "No shadow copies found") {
    Write-Host "[ALERT] No Volume Shadow Copies found. Possible deletion." -ForegroundColor Red
} else {
    Write-Host "[INFO] Shadow copies exist." -ForegroundColor Green
}

# 3. Check for RDP Brute Force Indicators (Event ID 4625 failures)
$rdpFailures = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4625)]] and *[EventData[Data[@Name='LogonType']='10']]" -MaxEvents 10 -ErrorAction SilentlyContinue
if ($rdpFailures) {
    Write-Host "[WARN] Recent RDP Logon Failures detected:" -ForegroundColor Yellow
    $rdpFailures | Select-Object TimeCreated, Message | Format-List
}


---

Incident Response Priorities

T-Minus Detection Checklist

If CVE-2026-20131 or CVE-2025-5777 is suspected:

1. Network Logs: Immediately review firewall and proxy logs for successful VPN connections originating from unusual GeoIPs or non-corporate devices.
2. Service Accounts: Audit logs for usage of the nsroot (Citrix) or admin (Cisco) accounts from IPs not in the management allow-list.
3. Mail Servers: Hunt for SMTP authentication logs where the session establishes without a standard login handshake (indicator of CVE-2026-23760).

Critical Assets for Exfiltration

Based on THEGENTLEMEN's victim profile:

• Intellectual Property: CAD files (Manufacturing), Source Code (Technology).
• PII/PHI: Patient databases (Healthcare).
• Financial Data: Audit reports, M&A due diligence folders (Business Services).

Containment Actions

1. Isolate: Immediately disconnect affected Cisco FMC, Citrix ADC, and Mail servers from the network if compromise is suspected.
2. Revoke: Force-reset credentials for all local admin accounts on edge appliances and rotate VPN certificates.
3. Block: Block outbound traffic to known Rclone/Cloud Storage endpoints at the firewall.

Hardening Recommendations

Immediate (24 Hours)

• Patch: Apply patches for CVE-2026-20131 (Cisco FMC) and CVE-2025-5777 (Citrix ADC) immediately.
• MFA: Enforce Multi-Factor Authentication (MFA) on all VPN and management interfaces. THEGENTLEMEN frequently exploits auth bypass; MFA provides a layer of defense if the bypass fails or is partial.
• Access Lists: Restrict management access to edge devices (Firewall/ADC) to specific internal jump hosts or IPs.

Short-Term (2 Weeks)

• Network Segmentation: Ensure management interfaces for critical infrastructure (Cisco FMC) are not accessible from the general corporate LAN or internet without strict segmentation.
• Web Application Firewalls (WAF): Deploy WAF rules to detect exploitation attempts against SmarterMail and React Server Components endpoints.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub