Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

The report details an August 2025 ransomware campaign attributed to an emerging group named "The Gentlemen," describing extensive reconnaissance, exploitation of internet-facing infrastructure (notably a compromised FortiGate), use of legitimate tools and vulnerable drivers for defense evasion, GPO abuse for domain-wide impact, AnyDesk-based persistence, WinSCP exfiltration, and a password-protected ransomware deployed via NETLOGON; it provides IOCs, MITRE ATT&CK mappings, victimology, and targeted defensive recommendations.