6 Critical Steps to Take When “The Gentlemen” Strike

1764181625

⚠️ “The Gentlemen” Are at the Door: Are You Ready for the New Era of Ransomware?

🧠From Cyber Gang to “Tech Startup.”

“The Gentlemen” aren’t your typical smash-and-grab ransomware crew.

They behave more like a well-funded software company: they conduct reconnaissance, customize tools for each victim, abuse built-in admin utilities, and target not just PCs but Windows servers, Linux, and VMware ESXi. Once they’re in, they move fast and quietly.

If you’re staring at a ransom note mentioning “The Gentlemen” (or any modern RaaS group), the next few hours matter more than anything else.

This guide walks through how to respond, step by step:

  • What to do in the first hour
  • How to contain the damage without destroying evidence
  • How to approach forensics, recovery, and communication
  • What you can put in place now so you’re not improvising later

Use this as both a “break glass” playbook and a conversation starter with your leadership team.

Step 1: Recognize What You’re Dealing With

Modern ransomware isn’t just “files encrypted.”

With groups like The Gentlemen, you should assume all of the following:

  • Data theft (double extortion): They likely exfiltrated sensitive data before encrypting.
  • Domain-wide impact: They often use tools such as PsExec, PowerShell, WMI, and Group Policy to spread ransomware across the entire Windows domain.
  • Cross-platform scope: They may target file servers, domain controllers, Linux servers, and ESXi – not just employee laptops.
  • Defensive tampering: Security agents, logging, or backups may have already been disabled or tampered with.

Your mindset:

This is a full environment compromise until proven otherwise, not just “a few infected machines.”

Step 2: First Hour – Stabilize and Contain (Without Panicking)

The biggest mistakes usually happen in the first hour: people power everything off, or start deleting files and logs.

Instead, focus on safe containment:

  1. Assemble your incident team immediately
    • Name an incident commander (someone who makes the final calls).
    • Pull in IT, security, legal/compliance, and communications.
    • If you have an external IR partner or cyber insurance, activate them now.
  2. Isolate, don’t erase
    • Disconnect obviously affected systems from the network:
      • Unplug network cables or disable switch ports.
      • Disable Wi-Fi / VPN access for affected hosts.
    • Do not:
      • Wipe disks
      • Rebuild systems yet
      • Mass-reboot everything
    • You need evidence to understand how they got in and what they touched.
  3. Lock down remote access
    • Disable:
      • Exposed RDP where practical
      • Shared admin accounts
      • Unknown or unneeded VPN/RMM accounts (AnyDesk, ScreenConnect, etc.)
    • Rotate passwords for:
      • Domain admin accounts
      • Firewall / VPN / FortiGate admin accounts
      • Service accounts that touch many systems
  4. Preserve logs and snapshots
    • Ensure your SIEM, firewall, VPN, and EDR logs are retained rather than rolled over.
    • Take snapshots of critical servers and virtual machines if storage allows.
    • If you have immutable/offline backups, verify their last known good date.

Your goal in this phase:

Stop the bleeding and protect evidence so your responders can see what happened.

Step 3: Next 24 Hours – Investigate, Contain, and Eradicate

Once the immediate fire is under control, you move into a structured investigation.

3.1 Understand the Initial Access

You need to answer: “How did they get in?”

Common entry points for groups like The Gentlemen include:

  • Exploited internet-facing services (VPNs, firewalls, RDP gateways, web apps)
  • Compromised administrator credentials
  • Malicious use of remote tools (AnyDesk, other RMMs)
  • Phishing that led to malware or credential theft

Work with your IR team to:

  • Correlate first suspicious activity in logs (VPN, FortiGate, firewall, RDP, email).
  • Identify the first compromised account and device.
  • Confirm whether the same vector is still exposed (e.g., unpatched FortiGate, old VPN portal, weak MFA).

If you don’t close this door, you risk re-infection after recovery.

3.2 Map Their Footprint

Groups like The Gentlemen are methodical. Expect to see:

  • Network scans (Advanced IP Scanner, Nmap, built-in Windows commands)
  • Enumeration of:
    • Domain controllers
    • File servers
    • Backup infrastructure
    • Virtualization infrastructure (ESXi, vCenter, storage)
  • Use of:
    • PsExec, WMI, PowerShell, scheduled tasks
    • Group Policy changes
    • Remote tools (AnyDesk, PuTTY, WinSCP, etc.)

Have your responders:

  • Build a timeline: initial access → recon → lateral movement → data theft → encryption.
  • Identify all systems where the attackers had admin-level access.
  • Look for persistence mechanisms:
    • New local admin accounts
    • Startup tasks/services
    • Malicious GPOs
    • New SSH keys or cron jobs on Linux/ESXi

3.3 Contain and Eradicate

When you understand the scope, systematically:

  • Disable compromised accounts and reset passwords across:
    • AD
    • VPN and firewall admin
    • Service accounts
    • Cloud accounts tied into on-prem (O365, Azure, etc.)
  • Remove persistence:
    • Kill malicious services, drivers, tasks
    • Clean or delete compromised GPOs
    • Remove unauthorized RMM tools
  • Segment the network:
    • Restrict lateral movement between critical zones (AD, backups, virtualization, production apps).
    • Tighten firewall rules around admin interfaces (vCenter, ESXi, FortiGate, storage appliances).

Only after this do you start rebuilding and restoring.

Step 4: Recovery – Restore Safely, Not Quickly

Ransomware response always has pressure: leadership wants systems back yesterday.

But restoring too early—before you’re sure the intruder is gone—can put you right back where you started.

4.1 Validate Your Backups

Before touching production, confirm:

  • Do you have offline or immutable backups from before the attack?
  • Are they clean (no ransomware binaries or backdoors)?
  • Can you test-restore a subset into an isolated environment?

Never restore critical systems directly into the same, still-hazy environment.

4.2 Prioritize Business Services

Work with business owners to prioritize:

  1. Critical revenue or safety systems (ERP, EMR, manufacturing, etc.)
  2. Identity and access (AD, SSO)
  3. Key line-of-business apps and file shares
  4. Lower-priority or internal-only systems

For each:

  • Rebuild from known-good images where possible.
  • Apply all critical patches (especially on internet-facing devices and virtualization platforms).
  • Enforce MFA on remote access and privileged accounts.
  • Re-join the network only after:
    • Security tools (EDR/AV, logging, monitoring) are in place and validated.
    • You’ve verified no leftover persistence.

4.3 Watch Closely After Cutover

For at least several weeks:

  • Monitor for:
    • New suspicious admin logins
    • Unexpected RDP / PowerShell / WMI activity
    • Anomalous file encryption patterns
  • Keep heightened logging and alerting on:
    • Domain controllers
    • VPNs / firewalls
    • ESXi / hypervisors
    • Backup servers

Think of this phase as “post-operative monitoring” for your environment.

Step 5: Communication, Legal, and Regulatory Response

Ransomware is as much a business crisis as a technical one.

5.1 Coordinate Messaging

Work with leadership, legal, and communications to:

  • Align on what you know and what you don’t know yet.
  • Create consistent messaging for:
    • Employees
    • Customers and partners
    • Regulators (if applicable)
    • Media (if you’re a larger or public-facing organization)

Keep messages:

  • Honest (no sugar-coating)
  • Clear (avoid technical jargon)
  • Focused on:
    • Impact
    • Steps you’re taking
    • What stakeholders should do (e.g., change passwords, watch for phishing)

5.2 Law Enforcement and Regulators

Depending on your region and industry:

  • You may have legal obligations to notify:
    • Data protection authorities
    • Sector regulators (e.g., healthcare, financial services)
  • Reporting to law enforcement can:
    • Support any future legal action
    • Provide threat intel and decryption help in some cases

Coordinate this with legal counsel and your incident response team.

5.3 Ransom Decisions

Whether or not to pay a ransom is a business, legal, and ethical decision.

Key points:

  • Paying does not guarantee:
    • Working decryption keys
    • That stolen data won’t be leaked or sold anyway
    • That you won’t be attacked again
  • In some jurisdictions, paying certain sanctioned entities may be illegal.

Any discussion of payment should involve:

  • Legal counsel
  • Executive leadership
  • Your cyber insurance carrier (if applicable)
  • Your incident response firm (for intelligence on the group’s past behavior)

Step 6: Build a Playbook Before You Need It

The best time to write an incident response plan is before you see a ransom note.

Use groups like The Gentlemen as a blueprint for what to defend against:

  1. Harden Internet-Facing Services
    • Keep firewalls, VPNs, and remote access tools patched.
    • Restrict admin interfaces (FortiGate, vCenter, ESXi, storage) to VPN/management networks only.
    • Enforce MFA everywhere, especially for privileged access.
  2. Segment Your Network
    • Separate:
      • AD
      • Backups
      • Virtualization
      • Production apps
    • Limit lateral movement between zones.
  3. Protect Identity and Privilege
    • Eliminate shared admin accounts.
    • Use tiered admin models and just-enough / just-in-time access.
    • Monitor for:
      • New domain admins
      • Unusual logon patterns
      • Admin activity from untrusted locations
  4. Invest in Logging and Detection
    • Centralize logs (firewall, VPN, AD, EDR, ESXi, critical apps).
    • Tune detections around:
      • LoTL abuse (PsExec, PowerShell, WMI, GPO changes)
      • Unusual RMM activity (AnyDesk, ScreenConnect, etc.)
      • High-volume data movement (exfiltration)
  5. Backups and Recovery
    • Maintain offline/immutable backups.
    • Regularly test and restore mission-critical systems.
    • Document RTOs/RPOs (how fast and how far back you can restore).
  6. Exercise the Plan
    • Run tabletop exercises at least annually:
      • Ransomware encrypts your file server.
      • Ransomware hits ESXi and vCenter.
      • Attackers abuse a firewall/VPN admin account.
    • Include leadership, legal, and communications, not just IT.

Final Thoughts

The Gentlemen are part of a broader trend: ransomware crews that operate like agile tech startups instead of chaotic hackers. They conduct recon, customize tools, automate propagation, and hit the layers of your stack that matter most: identity, virtualization, and data.

You can’t control who is going to knock next.
You can control how ready you are to respond.

An effective incident response plan, backed by strong fundamentals—identity security, segmentation, logging, and tested backups—turns a ransomware event from an existential crisis into a serious but manageable security incident.