The Gentlemen Ransomware Group Exploits Unpatched Systems Globally

The Gentlemen ransomware group has become the second most active ransomware gang by victim count, leveraging an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims.

Understanding the Attack Vector

The Gentlemen ransomware group utilizes an affiliate model to drive its rapid growth, exploiting unpatched systems and vulnerabilities in various products, including those from Microsoft and Fortinet, which are currently being actively exploited according to CISA's Known Exploited Vulnerabilities catalog.

Ransomware Mechanics

Ransomware attacks like those conducted by The Gentlemen group often involve initial access through exploited vulnerabilities or phishing campaigns, followed by lateral movement and data encryption, using techniques outlined in the MITRE ATT&CK framework, such as T1190: Exploit Public-Facing Application and T1486: Data Encrypted for Impact.

According to Unit 42, The Gentlemen ransomware operations are characterized by their ruthless and efficient approach, with a focus on rapid encryption and ransom demands.

Who Is Affected

Organizations across various sectors and regions are potentially affected by The Gentlemen ransomware group, particularly those with unpatched systems or inadequate security controls. The group's affiliate model and exploitation of known vulnerabilities make it a global threat.

What the Sceptics Say

Some sceptics argue that the threat posed by The Gentlemen ransomware group may be overhyped, given that many of the vulnerabilities they exploit have existing patches. However, the group's ability to rapidly adapt and evolve its tactics, techniques, and procedures (TTPs) makes it a significant concern for security teams.

How to Defend

• Prioritize patching of known vulnerabilities, particularly those listed in CISA's Known Exploited Vulnerabilities catalog.
• Implement robust security controls, including firewalls, intrusion detection systems, and antivirus software.
• Conduct regular security audits to identify and address potential vulnerabilities.
• Develop an incident response plan to quickly respond to and contain ransomware attacks.

Key Takeaways

1. Security Teams: Prioritize patching and implementation of robust security controls to prevent initial access and lateral movement.
2. CISOs: Develop an incident response plan and conduct regular security audits to identify and address potential vulnerabilities.
3. Developers: Ensure secure coding practices and implement robust security controls in software development.
4. End Users: Be cautious of phishing campaigns and avoid suspicious emails or links that may lead to ransomware infections.

Sources

• Krebs on Security: Who Runs the Ransomware Group ‘The Gentlemen?’
• Infosecurity Magazine: The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat
• Graham Cluley: The Gentlemen ransomware: what you need to know
• Unit 42: No Manners Here: The Ruthless Rise of The Gentlemen Ransomware