Overview of the Gentlemen Ransomware Threat
The Gentlemen ransomware group has initiated a potent cyberattack strategy that jeopardizes the security and recovery capabilities of affected systems. This ransomware can disable essential security measures such as Microsoft Defender, halt backup services, and erase Volume Shadow Copies, significantly complicating the recovery process for victimized organizations.
Technical Tactics and Impact
By tampering with security protocols, the ransomware efficiently disables real-time protection and sets wide-ranging exclusions to evade detection. In addition to encrypting files, the malware deletes system logs and other critical records, making forensic investigations challenging. The attack employs a double-extortion tactic, threatening data exposure even when backups are available.
Acronis’ Threat Research Unit has thoroughly analyzed The Gentlemen’s operations, revealing its use of Go-based ransomware-as-a-service targeting various systems, including Windows and Linux. The group claims to have affected over 800 victims, though these figures require independent verification.
Operational Mechanisms and Defensive Measures
On Windows systems, the ransomware disables Defender’s monitoring capabilities and adds exclusion lists, allowing it to encrypt files with minimal interruption. It also halts processes linked to security, databases, and virtual machines, exacerbating the impact by preventing routine recovery operations. The malware further removes Volume Shadow Copies, crucial for file restoration.
For network spread, the ransomware uses techniques like scheduled tasks and registry entries to maintain persistence, and it can propagate through network shares using PsExec. This ability to move laterally across networks poses a significant risk, as detailed in Cyber Security News.
Encryption and Exploit Techniques
The ransomware employs the ChaCha20 encryption algorithm and elliptic-curve cryptography for securing file keys. Files are encrypted based on size, with smaller files encrypted entirely and larger ones in sections. The malware also leaves a ransom note in compromised folders.
Acronis reports the use of vulnerable drivers to disable security processes at the kernel level. This exploitation technique, known as “bring your own vulnerable driver,” involves utilizing drivers with known vulnerabilities, such as Safetica ProcessMonitorDriver and Lenovo’s BootRepair.sys, to bypass security restrictions.
Prevention and Response Strategies
Organizations are advised to monitor for unexpected changes in Defender settings, halted security services, and unusual driver installations. Acronis recommends maintaining active endpoint detection, patching systems, limiting administrative access, and segmenting networks to mitigate the ransomware’s spread.
Regularly testing and securing backups with strict access controls can ensure a recovery path remains viable even if administrator accounts are compromised. Microsoft advises restoring from verified offline backups to minimize damage.
Overall, while comprehensive defenses cannot guarantee prevention of every attack, they significantly reduce the potential for widespread impact from ransomware incidents like those orchestrated by The Gentlemen.
