Ransomware Abuses SYSTEM Task to Encrypt Drives with Elevated Privileges

This report analyzes 'The Gentlemen' ransomware, a rapidly adopted RaaS strain that uses SYSTEM-level scheduled tasks to perform robust per-file encryption (Curve25519 + XChaCha20), disables defenses (Defender, shadow copies, logs), and aggressively propagates across networks via PsExec, WMI, scheduled tasks, services, and PowerShell remoting while employing double extortion; it includes IOCs (SHA-256 hashes) and recommends prioritizing detection of scheduled task abuse, privilege escalation, and unusual lateral movement.