Gentlemen Ransomware Disables Windows Defender, Deletes Backups

Key Takeaways

• The Gentlemen ransomware operation employs sophisticated tactics to disable security measures and destroy backups, hindering recovery efforts.
• Its Windows malware specifically targets Microsoft Defender, backup services, and Volume Shadow Copies, alongside clearing forensic evidence.
• The group utilizes a double-extortion model, combining data encryption with data exfiltration, increasing the risk of privacy breaches.
• First identified in 2025, this Go-based Ransomware-as-a-Service (RaaS) targets various operating systems, including Windows, Linux, NAS, and BSD.
• Defenders must prioritize robust endpoint detection, timely patching, restricted administrative access, and network segmentation to mitigate risk.

Gentlemen Ransomware: A Deeper Dive into its Evasive Tactics

The Gentlemen ransomware, a formidable operation in the cyberthreat landscape, has been observed deploying a multi-pronged attack strategy designed to maximize disruption and impede victim recovery. This sophisticated ransomware-as-a-service (RaaS) leverages a combination of security system manipulation, service disruption, and file encryption, making it particularly challenging for compromised organizations to restore their operations.

Disabling Defenses and Erasing Tracks

A core component of the Gentlemen ransomware’s attack chain involves actively undermining host defenses. Its Windows-specific malware is engineered to deactivate Microsoft Defender’s real-time protection and introduce extensive exclusions to its scanning routines. These actions create a permissive environment for the ransomware to operate unimpeded. Furthermore, the malware terminates services crucial for data backup and deletes Volume Shadow Copies, a common method for Windows users to revert to previous file versions. This systematic dismantling of recovery mechanisms severely complicates restoration efforts for victims.

Beyond file encryption, the Gentlemen ransomware also focuses on forensic evasion. It can clear event logs, prefetch data, and PowerShell command history, effectively obscuring the attacker’s activities and hampering post-incident investigations.

The group operates under a double-extortion model, meaning that in addition to encrypting data, they also exfiltrate sensitive information. This tactic significantly increases the stakes for victims, as even with robust backups, they face the threat of public data exposure if they refuse to pay the ransom. This underscores the critical importance of protecting not only data integrity but also data confidentiality in ransomware defense strategies.

Technical Analysis and Modus Operandi

Analysts from Acronis’ Threat Research Unit identified these behaviors in their detailed technical analysis of The Gentlemen ransomware. Their report details a Go-based RaaS operation that emerged in 2025, demonstrating versatility by targeting Windows, Linux, network-attached storage (NAS), and BSD systems. While the group claims over 800 victims, Acronis notes that this figure reflects the group’s assertions and not independently verified infections.

On Windows systems, the ransomware’s initial actions include attempting to disable Defender’s real-time monitoring and adding its executable and the entire C: drive to exclusion lists. This enables the malware to execute its payload with minimal interference. It further exacerbates the situation by stopping various processes and services related to security tools, databases, virtual machines, email, and backup products. This comprehensive disruption aims to ensure that no active processes can interfere with encryption or facilitate recovery.

The ransomware employs a rapid encryption process. Files smaller than 1 MB are fully encrypted, while larger files are processed in sections to speed up the operation. For encryption, it utilizes ChaCha20, securing the file keys with elliptic-curve cryptography. Encrypted files are marked with a variable extension, and a ransom note is deposited in affected directories.

Advanced Evasion Techniques: Bring Your Own Vulnerable Driver

A notable aspect of the Gentlemen ransomware’s toolkit is a separate utility designed to terminate security processes at the kernel level. This tool achieves its objective by dropping and installing vulnerable drivers as services. Specifically, Acronis identified a driver linked to Safetica ProcessMonitorDriver, associated with <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/868b0ef2-03cc-4df9-94f9-10dbfed51ae4/Hackers-Use-Gentlemen-Ransomware-to-Disable-Windows-Defender-and-Destroy-Backups.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Checksum-Mode=ENABLED&X-Amz-Credential=ASIA2F3EMEYE2RA4FXG7%2F20261021%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261021T151002Z&X-Amz-Expires=1637&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEJf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCg8nqrFQP17wSlmN5fXdrQ6OOAl8B198%2Fx9cJmzbjBtQIgeEpHA4Rb8k0pQ2vOJI7SSLpR5fJPEovUtxY1CB6bNRwqgAUIYBABGgw2OTk3NTMzMDk3MDUiDHMzZB3kvL8u6tLFjirdBC7V5YoVf1a3q0AZa2LGMvYzLnddgh68iJyqSskpGFB8puYf%2F3JKM0Sp8jzwk4kRSyP3DT1HMcbWquFKCHU%2FC20FGxKyBjzaiC9tXm8FAZi2ujTMBOCjt38zXNKug4rAQHFqOqJSgfmjXfgfyFhn3M2LDpbphSi9%2F9otvyU1MT5VwtdeVFcmCW%2FUypAu1TXkBXpj2uV%2B7BM5xWX53iWOl6OSCelTLLDc7h09WCHj5t26SkycuDIVIgJs2UzM2RPpdSPxTr1mVv6A3%2B4SpUXjBLbRwSeVnpWzzbiTUaMHADpFS1Nm9xhXm012qPgRbM2LtofR%2FvseGf%2BWbycp2aW6nSMqgGM%2BPLT0QRJKw7BJSLdf9v0DnWYlbupuZcAt%2FIb8qQPhBnZP88qsS6v9%2Fv16hggh%2BCMTxOV6tpOYfzbS5eaDDFSEB3%2FQVf9GTseCGG6Em3uzosdK0Yoy2ng%2FOTeLnfcUm1nFQawtXKU84K82hmus8d9wXQyLn89vvDUrlYLTxQif1bLBO1l5wInKAdXA3Xo5frOvFygGhOylhUpgCKR9o7nCQFkwbdTpIq%2F0PsM%2BYqBevZl5rmZU%2FZ0eNlcR8sigFaqwzpB2RC8aE8n4%2FZ%2FUulXCBQpT5mum7d5SXoyr3i1%2BqYinK%2BBPbOXAb5JitNQEFADgLFHnFpiZgr8lbYBWDzRRsQm6mfV6upFIiXZZUj1rFLcowT3wbqOQ7%2FRsGJRRf%2Fvq6dwhBwIknPtBuqV%2Bdk8AQ9tYHXp%2BXdpWHJ55t%2F5fNImTYMcAgNVONOZBpSBgA7QcJ8Hk4e8c5bsJMNyc49YGOpgBTbxxqZB8RhxRSi78mYFzRopoUuc%2B3iNYnG%2BXpIwQ4cAuCD%2BAvrI0PQtx5hSuSzQT%2BeSXX3Tt0Y0haDieGhneHvQ6YyJwy6kKr44NRn3FN

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.