The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions via PowerShell + Scheduled Tasks (Huntress April/May 2026 IRs)
The Gentlemen Ransomware (RaaS) (TL-2026-0555), also tracked as The Gentlemen RaaS, is a high-severity ransomware operation, first published 2026-05-21. It is attributed to The Gentlemen with medium confidence, affects Microsoft Windows, maps to 24 MITRE ATT&CK techniques (T1003.001, T1005, T1021.002), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0555
- Threat ID
- TL-2026-0555
- Also known as
- The Gentlemen RaaS, Gentlemen Ransomware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-05-21
- Last reviewed
- 2026-05-21
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, healthcare, professional-services, construction, education, financial, technology
- Target regions
- North America, Europe, Latin America, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in The Gentlemen Ransomware (RaaS)
Malware and tooling: the gentlemen, Rclone - S1040
The Gentlemen is an active ransomware-as-a-service operation (active since mid-2025, 400+ claimed victims in 70+ countries) whose affiliates rely heavily on living-off-the-land defense evasion: clearing Security/System/Application Event Logs with wevtutil, disabling Microsoft Defender via Set-MpPreference and registry edits, adding sweeping antivirus exclusions, and abusing Scheduled Tasks plus PowerShell for execution and persistence. Huntress documented two April-May 2026 incident responses where operators iterated these TTPs after an initial encryptor deployment was blocked, and a May 2026 leak of the group''s internal database revealed dedicated security-tool evasion tooling and Windows-logging-abuse capabilities.
How The Gentlemen Ransomware (RaaS) works
The Gentlemen is a ransomware-as-a-service (RaaS) operation first observed in mid-2025 that has scaled rapidly into one of the more prolific 2025-2026 extortion brands, advertising more than 400 victims across 70+ countries on Ransomware.live and operating dedicated leak infrastructure. The group runs a classic affiliate model: a core development team maintains the Windows encryptor and a custom defense-evasion toolset, while affiliates carry out intrusion, lateral movement, data theft, and encryption against negotiated revenue splits.
Huntress published a May 2026 analysis covering two April-May 2026 incident response engagements in which The Gentlemen affiliates exhibited a consistent post-compromise playbook centered on aggressive defense evasion. In both cases the operators leveraged Scheduled Tasks (schtasks.exe) and PowerShell as their primary execution and persistence primitives, and only escalated to noisier defense-evasion behavior after their initial ransomware payload was blocked by endpoint protection. Once the encryptor failed, affiliates pivoted to (1) clearing the Windows Security, System, and Application Event Logs using wevtutil cl, (2) disabling Microsoft Defender real-time protection and tamper protection via PowerShell Set-MpPreference cmdlets and direct registry writes under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, and (3) seeding broad antivirus exclusions for the directories from which they staged tooling and the encryptor binary. Affiliates then re-launched the encryptor; in both engagements the second attempt succeeded on hosts where the defense-evasion sequence executed without intervention.
A secondary stream of intelligence comes from an early May 2026 leak of the group''s internal database, which Huntress and Trend Micro independently reviewed. The leaked material confirms the existence of bespoke evasion utilities developed in-house — including a Defender-disabling helper that combines PowerShell, registry edits, and service stop primitives, and a logging-abuse module that targets the Windows Event Log service (EventLog) directly, both clearing existing logs and tampering with the log channel configuration to suppress future telemetry from specific Event IDs. The leak also exposed operator naming conventions for Scheduled Tasks (often masquerading as Microsoft or Windows Update tasks), preferred staging directories under C:\ProgramData and C:\Users\Public, and reusable PowerShell wrappers used to load encryptor components reflectively in memory.
Observed kill-chain. Initial access in the documented IRs has consistently come from valid remote-access credentials (VPN/RDP) acquired from initial access brokers, consistent with broader RaaS economics. Affiliates conduct discovery using built-in tools (whoami /all, net group /domain, nltest /dclist) and lightweight third-party scanners staged from C:\ProgramData. Privilege escalation is typically achieved by abusing already-acquired domain credentials rather than exploits, with lateral movement performed over SMB, WinRM, and PsExec-equivalent tooling. Persistence is overwhelmingly Scheduled Task-based: tasks are created under SYSTEM context with names that imitate legitimate Microsoft update or telemetry tasks (e.g., \Microsoft\Windows\UpdateOrchestrator\<random>). Defense evasion is where the operation is most distinctive — the group treats Event Log clearing, Defender tampering, and AV exclusion seeding as a single scripted sequence that runs immediately before encryptor staging.
Impact. Encryption is performed by a Windows PE encryptor that enumerates local fixed and network-mapped drives, terminates processes that hold open file handles on target paths (databases, mail stores, backup agents), and writes ransom notes into each impacted directory. Double extortion is standard: data is exfiltrated prior to encryption (typically via rclone or similar to attacker-controlled cloud storage) and victims who refuse to pay are listed on the group''s leak site. Recovery is generally limited to backup restoration as no public decryptor has been released.
Defender relevance. The April-May 2026 Huntress engagements show that this group''s playbook can be detected and disrupted at multiple choke points: (a) the wevtutil cl Security/System/Application sequence is itself an extremely high-fidelity behavioral signal, (b) Set-MpPreference -DisableRealtimeMonitoring $true and bulk AV exclusion additions are detectable via Defender''s own operational logs and via PowerShell ScriptBlock logging (Event ID 4104), (c) Scheduled Task creation under SYSTEM with names that imitate Microsoft tasks but launch PowerShell with encoded commands is observable via Event IDs 4698/4702 and Microsoft-Windows-TaskScheduler/Operational, and (d) the post-block re-run pattern (encryptor fails -> evasion sequence -> encryptor re-run) gives EDR and IR teams a documented detection window between the first failed encryption attempt and the second successful one.
MITRE ATT&CK techniques used in TL-2026-0555
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Collection
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.006 Remote Services: Windows Remote Management
Defense Evasion
T1027.010 Obfuscated Files or Information: Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location
Execution
T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution
Discovery
T1069.002 Permission Groups Discovery: Domain Groups; T1082 System Information Discovery; T1482 Domain Trust Discovery
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Persistence
T1078.002 Valid Accounts: Domain Accounts
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log; T1685.005 Clear Windows Event Logs
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Affected products and versions in The Gentlemen Ransomware (RaaS)
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022 - Microsoft — Microsoft Defender Antivirus
Vulnerable versions: all versions where Tamper Protection is disabled or not enforced
Fixed in: Defender with Tamper Protection enforced via Intune/MDE
Remediation for The Gentlemen Ransomware (RaaS)
Immediate actions
- Hunt for wevtutil cl Security|System|Application events across the estate (Event ID 1102 in Security log = log cleared)
- Alert on PowerShell Set-MpPreference -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, -DisableIOAVProtection, or -ExclusionPath additions originating from non-administrator-initiated sessions
- Block PowerShell execution from C:\ProgramData and C:\Users\Public via WDAC or AppLocker where business-feasible
- Enable and forward Microsoft-Windows-TaskScheduler/Operational logs centrally; alert on task creation under \Microsoft\Windows\ that launches powershell.exe with -enc or -EncodedCommand
- Validate Microsoft Defender Tamper Protection is enabled and enforced via Intune/MDE policy (prevents Set-MpPreference-based disable)
- Audit all VPN and RDP accounts for MFA enforcement; disable or password-rotate any account lacking MFA
Workarounds
- Enforce Microsoft Defender Tamper Protection via MDE/Intune to block Set-MpPreference-driven disable attempts
- Restrict use of wevtutil.exe via AppLocker or WDAC to administrative accounts only on servers; alert on any other use
- Where possible, run servers with Constrained Language Mode for PowerShell to neutralize reflective loader wrappers
Longer-term hardening
- Deploy EDR with behavioral detection tuned for the wevtutil + Set-MpPreference + Add-MpPreference -ExclusionPath sequence as a composite indicator
- Implement PowerShell ScriptBlock logging (Event ID 4104) and Module logging fleet-wide; ship to SIEM with at least 90-day retention
- Segment backup infrastructure (immutable/offline copies) so domain compromise does not equal backup compromise
- Run tabletop exercises against the documented post-block evasion sequence so SOC analysts recognize the encryptor-fail -> evasion -> encryptor-retry pattern as a high-priority escalation
Timeline of The Gentlemen Ransomware (RaaS)
- The Gentlemen RaaS operation first observed in the wild and begins listing victims on its dedicated leak site.
- The Gentlemen passes 200 cumulative claimed victims on Ransomware.live, establishing itself as a mid-tier RaaS brand.
- Huntress engages first April 2026 incident response involving The Gentlemen affiliate; initial encryptor deployment is blocked by endpoint protection.
- In the April 2026 IR, operators respond to the encryptor block by running wevtutil cl against Security/System/Application logs, disabling Defender via Set-MpPreference, adding AV exclusions, and re-launching the encryptor successfully on impacted hosts.
- Early-May 2026 leak of The Gentlemen operation''s internal database exposes custom defense-evasion tooling, Windows Event Log abuse modules, and operator naming conventions for Scheduled Tasks.
- Huntress engages second April-May 2026 incident response showing the same Scheduled Task + PowerShell + event-log-clearing + Defender-disable + AV-exclusion sequence, confirming the playbook is consistent across affiliates.
- The Gentlemen leak site lists 400+ cumulative claimed victims across 70+ countries at time of Huntress publication.
- Huntress publishes consolidated analysis of both April-May 2026 IRs and the leaked internal database, documenting The Gentlemen''s defense-evasion TTPs in detail.
- As of 2026-05-29, The Gentlemen RaaS remains fully active: Ransomware.live shows 442 victims with postings as recent as 2026-05-28, and the early-May internal leak was a rival hack, not a takedown. The group kept operating, same-day-patched an April decryptor, joined BreachForums as a partner (May 16), and added ThrottleBlood.sys EDR-killing per Microsoft/Check Point reporting.
Sources cited for The Gentlemen Ransomware (RaaS)
- The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs
- Trend Micro analysis of The Gentlemen custom defense-evasion tooling (referenced by Huntress)
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
- MITRE ATT&CK T1070.001 — Indicator Removal: Clear Windows Event Logs
- MITRE ATT&CK T1053.005 — Scheduled Task/Job: Scheduled Task
- Microsoft Defender Tamper Protection guidance
- Ransomware.live — The Gentlemen victim listings
Threats related to The Gentlemen Ransomware (RaaS)
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)
- The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation
- Payload Ransomware — Babuk-Derivative ChaCha20 + Curve25519 ECDH Per-File Encryption Targeting Windows and ESXi
- GodDamn Ransomware (Hyadina) — Third Rebrand from Monster/Beast, Deploys Signed PoisonX Kernel Driver
- The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts
Detection coverage for TL-2026-0555
As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0555 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.