Background: Trend Micro's 2025 research
This is not new research. On 9 September 2025 Trend Micro published "Unmasking The Gentlemen Ransomware", based on a campaign it investigated in August 2025. It described The Gentlemen as an emerging and previously undocumented group, and said the lack of earlier intelligence suggested either a rebrand by experienced operators or a well-funded new entrant.
Trend Micro reported victims in at least 17 countries, with a focus on the Asia-Pacific region and Thailand and the United States named as key targets. Manufacturing was hit hardest, followed by construction, healthcare and insurance. The group used double extortion, combining encryption with data theft.
How the group grew
Dark Reading reported in April 2026 that The Gentlemen, a ransomware-as-a-service operation that first appeared in mid-2025, had claimed hundreds of victims. Dillon Ashmore of NCC Group told Dark Reading that DragonForce "took almost two years to surpass 150 victims" while The Gentlemen "passed that milestone in nine months", and that the group had sustained this activity without the usual disruptions such as affiliate defections or infrastructure seizures.
Entry point
Trend Micro said the exact initial access vector was not confirmed. The attackers likely exploited internet-facing services or used compromised credentials. Network scan output showed a compromised FortiGate administrative account, and the FortiGate server was directly reachable from the internet, which Trend Micro said likely served as the entry point. The report does not name a FortiGate vulnerability. Advanced IP Scanner was used early for reconnaissance.
Driver abuse and anti-AV tools
The first defence evasion tool, All.exe, loads ThrottleBlood.sys, a legitimate signed but vulnerable driver, and uses it to terminate protected security processes. ThrottleBlood.sys is the only driver named in the report.
Allpatch2.exe is an enhanced version of that evasion tool, customised to stop key security agent components by terminating their processes. PowerRun.exe is a legitimate utility, often abused for privilege escalation, which the attackers used to try to run high-privilege operations to disable or terminate security services. Windows Defender was disabled using PowerShell.
Trend Micro said the group's tailored approach came from systematic analysis of security software documentation.
Group Policy abuse, exfiltration and persistence
The attackers used the Group Policy management consoles (gpmc.msc and gpme.msc), likely to push malicious configuration across the domain, and encoded PowerShell to locate the PDC Emulator. Trend Micro linked this to preparation for domain-wide ransomware deployment or GPO-based backdoors.
Data was likely exfiltrated with WinSCP, whose encrypted channels could evade network monitoring. AnyDesk provided a remote access channel that could survive incident response, and the attackers changed registry settings to weaken authentication and enable RDP, and modified firewall rules to keep access for negotiation.
Key points
- Trend Micro's analysis of The Gentlemen was published on 9 September 2025; it is background, not new research.
- Victims were in at least 17 countries, mainly in manufacturing, construction, healthcare and insurance, with a focus on Asia-Pacific.
- The likely entry point was an internet-facing FortiGate server with a compromised administrative account; the exact vector was not confirmed.
- All.exe loads the vulnerable ThrottleBlood.sys driver to kill security processes; Allpatch2.exe is an enhanced process killer; PowerRun.exe is a legitimate tool abused for high-privilege operations.
- GPO tooling was used for domain-wide deployment, WinSCP likely for exfiltration, and AnyDesk plus registry and firewall changes for persistence.
- NCC Group told Dark Reading in April 2026 that the group passed 150 victims in nine months.