The Gentlemen are knocking: сustom backdoors and evolving tactics

**Executive summary:** The report details 'The Gentlemen', a ransomware-as-a-service group actively targeting large organizations and critical infrastructure globally; it documents initial access methods (vulnerable internet-facing devices, leaked/default credentials, and IAB collaboration), internal reconnaissance and lateral movement tools (SharpADWS, NetScan, deploy_gpo.ps1, PsExec), security bypass techniques (BYOVD, vulnerable drivers, registry/PowerShell disables), custom Go and C ransomware/backdoor implants (including encryption schemes, parameters, and anti-sandbox password), and provides multiple indicators of compromise (binaries, driver hashes, file paths, and a backdoor C2 IP).