Thegentlemen

How Thegentlemen typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via The Gentlemen.

1. T1583.001 Domains Resource Development

   What they do: The Gentlemen has maintained a TOR Data Leak Site (DLS) to post stolen victim data.

   What that means: Adversaries may acquire domains that can be used during targeting.

2. T1585 Establish Accounts Resource Development

   What they do: The Gentlemen and its affiliates have leveraged Tox to communicate with victims.

   What that means: Adversaries may create and cultivate accounts with services that can be used during targeting.

3. T1585.001 Social Media Accounts Resource Development

   What they do: The Gentlemen has established social media accounts on X.

   What that means: Adversaries may create and cultivate social media accounts that can be used during targeting.

4. T1588.002 Tool Resource Development

   What they do: The Gentlemen has provided a custom EDR killing tool called GentleKiller and other like software that abuse vulnerable drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique to their affiliates that attempts to disable EDR solutions.

   What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.

5. T1683.001 Written Content Resource Development

   What they do: The Gentlemen has utilized branded code and ransom notes.

   What that means: Adversaries may create or tailor written materials to support targeting and malicious operations.

6. T1683.002 Audio-Visual Content Resource Development

   What they do: The Gentlemen has leveraged a branded graphic that is placed on the systems desktop wallpaper that symbolizes the association of malicious activity to the group.

   What that means: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations.

7. T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

   What they do: The Gentlemen has leveraged compromised user credentials to gain access to victim hosts.

   What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

8. T1190 Exploit Public-Facing Application Initial Access

   What they do: The Gentlemen has exploited vulnerable public-facing devices and services to gain access to victim environments.

   What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

9. T1068 Exploitation for Privilege Escalation Privilege Escalation

   What they do: The Gentlemen has assisted affiliates with gaining privilege escalation through the use of BYOVD.

   What that means: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

10. T1027.002 Software Packing Stealth

    What they do: The Gentlemen has packed The Gentlemen Ransomware binaries utilizing either Themida or Enigma to obfuscate the malicious payloads.

    What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.

11. T1036 Masquerading Stealth

    What they do: The Gentlemen has fabricated the version information of payload files to evade detection.

    What that means: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

12. T1036.001 Invalid Code Signature Stealth

    What they do: The Gentlemen has copied digital signatures from legitimate executables in attempts to circumvent detection.

    What that means: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

13. T1036.005 Match Legitimate Resource Name or Location Stealth

    What they do: The Gentlemen has named The Gentlemen Ransomware payload files to resemble well-known software vendors to include security vendors.

    What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

14. T1018 Remote System Discovery Discovery

    What they do: The Gentlemen has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

15. T1219.002 Remote Desktop Software Command and Control

    What they do: The Gentlemen has relied on remote access tools, such as AnyDesk, as a means of maintaining access to victim environment.

    What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.

16. T1486 Data Encrypted for Impact Impact

    What they do: The Gentlemen has used The Gentlemen Ransomware to encrypt victim’s data.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

17. T1657 Financial Theft Impact

    What they do: The Gentlemen has used double-extortion tactics to sway victims to pay a ransom to include exfiltrating sensitive data, encrypting files, and threatening public release if a payment is not received.

    What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Software Thegentlemen has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

[snip] = YOUR ID

Gentlemen, your network has been encrypted.

1. Any modification of encrypted files will make recovery impossible. 
2. Only our unique decryption key and software can restore your files. 
   Brute-force, RAM dumps, third-party recovery tools are useless.
   It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
   They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). 
   If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.
   In addition, it will be reported to the relevant data protection authorities and regulators.
   This may result in official investigations, significant fines, and reputational damage for your company.
6. We guarantee 100% file recovery to their original state, bit by bit.
   To demonstrate the quality of our work, you can provide three sample files, and we will restore them free of charge.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): 13343E50C1B3466F0EA35B5B3E55A044CB7132FD28A8665EFEA0E5848E276D548C21B79F15C2
Download Tox messenger: https://tox.chat/download.html
Contact us (add via SimpleX): https://smp14.simplex.im/a#4mlOiePV8NBXOv2QrZ9CaPeRPm1mBUgxn4SdpFnm978
Download SimpleX  https://simplex.chat/downloads/

СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER)
Check our blog: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ 
Download Tor browser: https://www.torproject.org/download/
Follow us on X: https://x.com/TheGentlemen26
Clearnet blog link: https://thegentlemen.cc/

Any other means of communication are fake and may be set up by third parties. 
Only use the methods listed in this note or on the specified website.
After adding (us) in Tox or Session, please wait for your request to be processed and stay online.
If you do not receive a reply within 36 hours, create another account and contact us again.
In your first message in chat, immediately provide your ID from the note and the name of your organization. 
Assign one person as contact responsible for all negotiations. Do not create multiple chats.

We have stolen more than 100 GB of your corporate information from your servers, including critically important data.

Your company is facing a massive information security breach. A total data leak has occurred. This greatly increases the risk of colossal financial and reputational losses.

[snip] = YOUR ID

Gentlemen, your network has been encrypted.

1. Any modification of encrypted files will make recovery impossible. 
2. Only our unique decryption key and software can restore your files. 
   Brute-force, RAM dumps, third-party recovery tools are useless.
   It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
   They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). 
   If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.
   In addition, it will be reported to the relevant data protection authorities and regulators.
   This may result in official investigations, significant fines, and reputational damage for your company.
6. We guarantee 100% file recovery to their original state, bit by bit.
   To demonstrate the quality of our work, you can provide three sample files, and we will restore them free of charge.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): 98C132E2B20B531BE6604397D97040C1E9EB42FCE12EDF119BCE8B4031CA5C70DAF5E65FA3C3
Download Tox messenger: https://tox.chat/download.html
Contact us (add via Session ID): 05809b2da1d5b1a302f48b5767fd1843d54f3c516f9ab0eb26b544ffa73340292e
Download Session  https://getsession.org

СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER)
Check our blog: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ 
Download Tor browser: https://www.torproject.org/download/
Follow us on X: https://x.com/

Any other means of communication are fake and may be set up by third parties. 
Only use the methods listed in this note or on the specified website.
After adding (us) in Tox or Session, please wait for your request to be processed and stay online.
If you do not receive a reply within 36 hours, create another account and contact us again.
In your first message in chat, immediately provide your ID from the note and the name of your organization. 
Assign one person as contact responsible for all negotiations. Do not create multiple chats.

[snip] = YOUR ID

Gentlemen, your network is under our full control.
All your files are now encrypted and inaccessible.

1. Any modification of encrypted files will make recovery impossible. 
2. Only our unique decryption key and software can restore your files. 
   Brute-force, RAM dumps, third-party recovery tools are useless.
   It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
   They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). 
   If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E
Download Tox messenger: https://tox.chat/download.html

COOPERATE TO PREVENT DATA LEAK (239 HOURS LEFT)
Check our blog: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ 
Download Tor browser: https://www.torproject.org/download/

Any other means of communication are fake and may be set up by third parties. 
Only use the methods listed in this note or on the specified website.

Ransom-note text from RansomLook, licensed CC BY 4.0.