An emerging ransomware-for-hire group called The Gentlemen has adopted an aggressive strategy to make recovery nearly impossible. Their Windows malware is built to disable Microsoft Defender, erase backup components, and destroy system restore features—all before encryption begins, according to a new technical breakdown led by Acronis analysts. These steps weaken defenses and render traditional recovery paths useless.
How Gentlemen Pulls It Off
The malware deactivates Defender’s real-time protection and adds wide-ranging exclusions—including protecting its own processes and the C: drive—to evade detection and remediation. It also halts services tied to security tools, virtual machines, databases, email systems, and backup software, effectively blindfolding system defenses. Volume Shadow Copies—Windows’ native way to restore earlier file versions—are deleted entirely.
Beyond merely disabling tools, Gentlemen attempts to scrub the system of forensic trails. It clears event logs, prefetch data, and PowerShell history, hampering incident investigations. For persistence, it deploys scheduled tasks, startup registry entries, and can spread laterally using PsExec across domain-joined machines.
Encryption, Tech & Open Attacks
Files under 1 MB are encrypted entirely; larger files are processed in blocks. The encryption uses ChaCha20 for data, protected via elliptic-curve cryptography for file-specific keys. Each version of the malware produces its own custom extension for encrypted files and drops ransom notes in every affected folder.
The group has also adopted a double extortion approach: they steal sensitive data before encrypting it, then threaten to expose stolen information if victims don’t comply—even those that might have backups. Since its emergence in 2025, Gentlemen has claimed over 800 victims, with targets across Windows, Linux, network-attached storage, and BSD systems.
Pivotal Weaknesses & Defensive Moves
Gentlemen leverages a technique known as “bring your own vulnerable driver,” installing flawed drivers to kill security processes at the kernel level. Among the drivers identified are one tied to Safetica’s ProcessMonitorDriver (CVE-2025-70795) and Lenovo’s BootRepair.sys. These allow the ransomware to bypass protections that user-level tools cannot reach.
Detection signs include altered Defender settings, disabled security or backup services, unexpected driver installation, cleared logs, and a rapid wave of encryption across multiple devices. These indicators are critical for alerting defenders early.
How Organizations Can Fight Back
To stay ahead, firms should monitor security tools continuously, apply patches to systems and drivers, restrict admin rights, track PowerShell and remote administration usage, and segment their networks. Backups need to be reliable, access-controlled, isolated or offline in some cases, so that even if attackers gain admin control they can’t erase recovery options. Microsoft also recommends restoring data only from authenticated, offline or immutable backup copies after an attack.
Privileged accounts should be closely guarded. Critical infrastructure and high-value endpoints deserve extra defenses which cannot be disabled or bypassed easily. Regular rehearsal of recovery plans is essential so teams know how to respond swiftly.
Gentlemen’s tactics demonstrate that successful ransomware defense isn’t just about preventing encryption—it’s about safeguarding recovery infrastructure too. Networks must assume that attackers will try to disable backups and forensic visibility, and build in redundancies, separation, and immutable snapshots. What to watch next: how widespread their driver exploits become, and whether ransomware-as-a-service variations crop up on Linux or BSD exploits.
