The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

The report describes the Gentlemen ransomware-as-a-service operation (GOLD SHERWOOD) that gains access via exposed firewall/VPN interfaces or stolen credentials, moves laterally using legitimate credentials and RDP, disables EDR and backup services, exfiltrates selected data for double extortion, and rapidly deploys encryption—sometimes in under 24 hours; Sophos analyzed 15 incidents, provides hashes and IoCs, and recommends patching internet-facing appliances, enforcing MFA, restricting RDP, and monitoring for staging and backup-disabling activity.