All news
threat actor activity

Precursor Intelligence

Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics

The group targets critical industries in 17 countries using custom tools to bypass enterprise endpoint protections.

18 August 2026
The GentlemenRansomwareTrend MicroDriver AbuseCybersecurity Threats
Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics

The Gentlemen's Rapid Ascent in the Ransomware Landscape

The Gentlemen emerged in mid-2025 as a previously undocumented ransomware-as-a-service operation, rapidly establishing itself through sophisticated tactics and advanced technical capabilities. The group distinguishes itself from opportunistic actors by targeting enterprise environments with tailored tools designed to bypass endpoint protections and disable security solutions. Its operational model relies on double extortion, combining data encryption with the threat of public leaks to pressure victims.

The scale of the group’s operations has expanded quickly, with attacks spanning at least 17 countries and concentrating heavily on critical industries including manufacturing, construction, healthcare, and insurance. Manufacturing organizations have been particularly hard hit, followed by firms in the construction and healthcare sectors. This broad geographic and sectoral reach underscores the group’s ability to sustain high-volume activity across diverse global markets.

The speed of The Gentlemen’s ascent has drawn comparisons to earlier ransomware groups, yet its pace is markedly faster. While DragonForce required nearly two years to surpass 150 victims, The Gentlemen reached that milestone in just nine months. Analysts note this rapid scaling reflects a high level of operational stability, free from the typical disruptions such as affiliate defections or infrastructure seizures that often hinder newer ransomware operations.

Abusing Legitimate Drivers for Defense Evasion

The Gentlemen’s intrusion methodology relies heavily on the exploitation of legitimate drivers to circumvent enterprise endpoint protections. Rather than deploying novel, easily detectable malware binaries for initial defense evasion, the group leverages signed system components that are trusted by security software. This approach allows their payloads to execute within the victim environment without triggering standard heuristic alerts or signature-based blocks.

The operation demonstrates a sophisticated understanding of defensive tooling, specifically targeting Windows Defender and FortiGate systems. By systematically analyzing public documentation from these security vendors, The Gentlemen identifies specific vulnerabilities and configuration weaknesses in endpoint agents. This intelligence is then applied to deploy environment-specific evasion techniques, ensuring that the legitimate drivers used for defense evasion are tailored to the precise security stack present on each compromised host.

Custom Anti-AV Tools and System Compromise

The Gentlemen deploys a suite of bespoke malicious utilities to neutralize endpoint defenses before executing its ransomware payload. Central to this operation are custom binaries including All.exe, Allpatch2.exe, and PowerRun.exe, which are engineered specifically to disable Windows Defender and other security agents present on compromised hosts. These tools allow the group to strip away real-time protection mechanisms, creating a window of vulnerability for subsequent lateral movement and data staging.

Beyond individual host compromise, the group leverages Group Policy Objects (GPO) to extend its reach across entire enterprise domains. By manipulating Active Directory infrastructure through GPO abuse, The Gentlemen facilitates domain-wide compromise, ensuring that security controls are disabled or bypassed simultaneously across multiple systems. This technique transforms a single initial intrusion into a systemic failure of organizational defenses, allowing the ransomware operation to propagate efficiently within targeted environments.

Operational Security and Data Exfiltration

To secure the transfer of stolen data, The Gentlemen employs WinSCP over encrypted channels, ensuring that exfiltrated information remains obscured from network monitoring tools during transit. This method allows the group to move sensitive assets out of compromised environments while maintaining a low profile against perimeter defenses.

Following data staging, the operation establishes redundant persistence mechanisms to ensure continued access even if initial footholds are disrupted. The group deploys AnyDesk remote access software alongside modified registry settings, creating multiple independent pathways for re-entry into victim systems. This layered approach guarantees that operators can maintain command and control over compromised infrastructure regardless of individual tool removal or system resets.

Key points

  • The Gentlemen ransomware group employs advanced, highly tailored tools specifically designed to bypass enterprise endpoint protections and disable security solutions.
  • The campaign leverages a combination of legitimate driver abuse for defense evasion and the manipulation of Group Policy Objects (GPO) to facilitate domain-wide compromise.
  • Victims are primarily located in critical industries such as manufacturing, construction, healthcare, and insurance across at least 17 countries, with a heavy focus on the Asia-Pacific region.
  • The group demonstrates operational security by utilizing encrypted channels for data exfiltration via WinSCP and establishing redundant persistence mechanisms through AnyDesk remote access software and modified registry settings.

Further reading & sources