[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw6l7J3G79eHZNE-pNUhI8eT_jtvBLKSMiKVWMTksJQs":3,"$fv6n0aOJUocoNf0tHL_dgr46Z4LrDwlBb_uPJbcdBgTQ":22},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":18,"created_at":19,"updated_at":20,"published_at":21},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Background: Trend Micro's 2025 Analysis of The Gentlemen Ransomware's Driver Abuse and Anti-AV Tools","Trend Micro's September 2025 research described a vulnerable-driver killer, GPO abuse and a likely FortiGate entry point; by early 2026 the group was among the most active ransomware operations.","In September 2025 Trend Micro published an analysis of The Gentlemen, then a previously undocumented ransomware group, describing a vulnerable-driver process killer, Group Policy abuse and attacks on manufacturing, construction, healthcare and insurance in at least 17 countries. This article summarises that research as background.",[10,11,12,13,14],"The Gentlemen","Ransomware","Trend Micro","Driver Abuse","Cybersecurity Threats","# Background: Trend Micro's 2025 Analysis of The Gentlemen Ransomware's Driver Abuse and Anti-AV Tools\n\n*Trend Micro's September 2025 research described a vulnerable-driver killer, GPO abuse and a likely FortiGate entry point; by early 2026 the group was among the most active ransomware operations.*\n\n**Tags:** `The Gentlemen` `Ransomware` `Trend Micro` `Driver Abuse` `BYOVD`\n\n> In September 2025 Trend Micro published an analysis of The Gentlemen, then a previously undocumented ransomware group, describing a vulnerable-driver process killer, Group Policy abuse and attacks on manufacturing, construction, healthcare and insurance in at least 17 countries. This article summarises that research as background.\n\n---\n\n## Background: Trend Micro's 2025 research\n\nThis is not new research. On 9 September 2025 Trend Micro published \"Unmasking The Gentlemen Ransomware\", based on a campaign it investigated in August 2025. It described The Gentlemen as an emerging and previously undocumented group, and said the lack of earlier intelligence suggested either a rebrand by experienced operators or a well-funded new entrant.\n\nTrend Micro reported victims in at least 17 countries, with a focus on the Asia-Pacific region and Thailand and the United States named as key targets. Manufacturing was hit hardest, followed by construction, healthcare and insurance. The group used double extortion, combining encryption with data theft.\n\n## How the group grew\n\nDark Reading reported in April 2026 that The Gentlemen, a ransomware-as-a-service operation that first appeared in mid-2025, had claimed hundreds of victims. Dillon Ashmore of NCC Group told Dark Reading that DragonForce \"took almost two years to surpass 150 victims\" while The Gentlemen \"passed that milestone in nine months\", and that the group had sustained this activity without the usual disruptions such as affiliate defections or infrastructure seizures.\n\n## Entry point\n\nTrend Micro said the exact initial access vector was not confirmed. The attackers likely exploited internet-facing services or used compromised credentials. Network scan output showed a compromised FortiGate administrative account, and the FortiGate server was directly reachable from the internet, which Trend Micro said likely served as the entry point. The report does not name a FortiGate vulnerability. Advanced IP Scanner was used early for reconnaissance.\n\n## Driver abuse and anti-AV tools\n\nThe first defence evasion tool, All.exe, loads ThrottleBlood.sys, a legitimate signed but vulnerable driver, and uses it to terminate protected security processes. ThrottleBlood.sys is the only driver named in the report.\n\nAllpatch2.exe is an enhanced version of that evasion tool, customised to stop key security agent components by terminating their processes. PowerRun.exe is a legitimate utility, often abused for privilege escalation, which the attackers used to try to run high-privilege operations to disable or terminate security services. Windows Defender was disabled using PowerShell.\n\nTrend Micro said the group's tailored approach came from systematic analysis of security software documentation.\n\n## Group Policy abuse, exfiltration and persistence\n\nThe attackers used the Group Policy management consoles (gpmc.msc and gpme.msc), likely to push malicious configuration across the domain, and encoded PowerShell to locate the PDC Emulator. Trend Micro linked this to preparation for domain-wide ransomware deployment or GPO-based backdoors.\n\nData was likely exfiltrated with WinSCP, whose encrypted channels could evade network monitoring. AnyDesk provided a remote access channel that could survive incident response, and the attackers changed registry settings to weaken authentication and enable RDP, and modified firewall rules to keep access for negotiation.\n\n## Key points\n\n- Trend Micro's analysis of The Gentlemen was published on 9 September 2025; it is background, not new research.\n- Victims were in at least 17 countries, mainly in manufacturing, construction, healthcare and insurance, with a focus on Asia-Pacific.\n- The likely entry point was an internet-facing FortiGate server with a compromised administrative account; the exact vector was not confirmed.\n- All.exe loads the vulnerable ThrottleBlood.sys driver to kill security processes; Allpatch2.exe is an enhanced process killer; PowerRun.exe is a legitimate tool abused for high-privilege operations.\n- GPO tooling was used for domain-wide deployment, WinSCP likely for exfiltration, and AnyDesk plus registry and firewall changes for persistence.\n- NCC Group told Dark Reading in April 2026 that the group passed 150 victims in nine months.\n\n## Further reading & sources\n\n- [Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed](https:\u002F\u002Fwww.trendmicro.com\u002Fen_us\u002Fresearch\u002F25\u002Fi\u002Funmasking-the-gentlemen-ransomware.html) — Trend Micro\n- ['The Gentlemen' Rapidly Rises to Ransomware Prominence](https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fgentlemen-rapidly-rise-ransomware) — Dark Reading","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png?v=fb82a8efc1",{},"threat_actor_activity","2026-08-18T18:29:37.334637+00:00","2026-10-16T12:29:26.988057+00:00",null,{"articles":23},[24,36,48,59],{"slug":25,"title":26,"summary":27,"tags":28,"hero_image_url":34,"story_type":18,"created_at":35},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[29,30,31,32,33,11],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":37,"title":38,"summary":39,"tags":40,"hero_image_url":45,"story_type":46,"created_at":47},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[41,42,43,11,44],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","ransomware_incident","2026-09-24T07:05:56.501709+00:00",{"slug":49,"title":50,"summary":51,"tags":52,"hero_image_url":57,"story_type":46,"created_at":58},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[53,11,54,55,56],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":60,"title":61,"summary":62,"tags":63,"hero_image_url":68,"story_type":46,"created_at":69},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[64,65,66,11,67],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00"]