The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress

What it is

Field-level detection detail for The Gentlemen ransomware (RaaS, active since mid-2025, 400+ claimed victims across 70+ countries), from two Huntress SOC incidents in April and May. In both, the Huntress agent was deployed post-incident, so there is no live EDR telemetry — the findings come from residual PowerShell and Windows Event Log artifacts. This adds specific IOCs and Event IDs that the catalog summary does not carry.

How it works

In the shipping/transportation incident, the actor connected via RDP with a compromised account, then ran the encryptor locally from the Documents folder:

C:\Users\REDACTED\Documents\win.exe --password REDACTED --T 200 --superfast

Microsoft Defender blocked this first attempt (Event IDs 1116 and 1117). Defender also caught the PowerShell exclusion-tampering script, detected as Trojan:Win32/MpTamperBulkExcl.H. The actor then created Scheduled Tasks — assessed as running on the Domain Controller because the expected local Microsoft-Windows-TaskScheduler/140 records were absent — one of which re-ran the encryptor. Finally they cleared the System, Application, and Security logs (Event ID 104 for Application/System, Event ID 1102 for Security).

What to do

Hunt for these concrete artifacts:

• Encryptor named win.exe run from a user Documents folder, with flags --password, --T, --superfast.
• Defender 1116/1117 blocks followed shortly by re-execution attempts.
• Defender signature Trojan:Win32/MpTamperBulkExcl.H (AV exclusion tampering).
• Event IDs 104 and 1102 indicating logs were cleared — treat as a breadcrumb, not a dead end (see caveat).
• Absence of TaskScheduler/140 on an endpoint where tasks clearly ran, suggesting task creation on the DC instead.

Per prior public reporting the page cites: patch Fortinet CVE-2024-55591 (auth bypass) as an initial-access vector, and watch for GPO abuse enabling domain-wide deployment and AnyDesk persistence.

Caveats

• Key limitation the authors state themselves: no EDR telemetry during the attack and no SIEM at either victim, so initial access could not be confirmed — the RDP connection is merely the earliest point of visibility, not proven entry.
• The actors cleared only three logs and left all others intact, so forensic footprints remain — the log-clearing is a lead, not total erasure.
• The DC-task inference rests on the missing TaskScheduler/140 records, not on direct DC evidence.
• Some techniques (custom evasion tooling, driver abuse, GPO, AnyDesk, the eight Tox affiliate IDs) come from Trend Micro, Check Point, and the leaked database rather than from these two incidents directly.