# The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions via PowerShell + Scheduled Tasks (Huntress April/May 2026 IRs)

> The Gentlemen is an active ransomware-as-a-service operation (active since mid-2025, 400+ claimed victims in 70+ countries) whose affiliates rely heavily on living-off-the-land defense evasion: clearing Security/System/Application Event Logs with wevtutil, disabling Microsoft Defender via Set-MpPreference and registry edits, adding sweeping antivirus exclusions, and abusing Scheduled Tasks plus PowerShell for execution and persistence. Huntress documented two April-May 2026 incident responses where operators iterated these TTPs after an initial encryptor deployment was blocked, and a May 2026 leak of the group''s internal database revealed dedicated security-tool evasion tooling and Windows-logging-abuse capabilities.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0555
- **ID:** TL-2026-0555
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Gentlemen is a ransomware-as-a-service (RaaS) operation first observed in mid-2025 that has scaled rapidly into one of the more prolific 2025-2026 extortion brands, advertising more than 400 victims across 70+ countries on Ransomware.live and operating dedicated leak infrastructure. The group runs a classic affiliate model: a core development team maintains the Windows encryptor and a custom defense-evasion toolset, while affiliates carry out intrusion, lateral movement, data theft, and encryption against negotiated revenue splits.

Huntress published a May 2026 analysis covering two April-May 2026 incident response engagements in which The Gentlemen affiliates exhibited a consistent post-compromise playbook centered on aggressive defense evasion. In both cases the operators leveraged Scheduled Tasks (schtasks.exe) and PowerShell as their primary execution and persistence primitives, and only escalated to noisier defense-evasion behavior after their initial ransomware payload was blocked by endpoint protection. Once the encryptor failed, affiliates pivoted to (1) clearing the Windows Security, System, and Application Event Logs using wevtutil cl, (2) disabling Microsoft Defender real-time protection and tamper protection via PowerShell Set-MpPreference cmdlets and direct registry writes under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, and (3) seeding broad antivirus exclusions for the directories from which they staged tooling and the encryptor binary. Affiliates then re-launched the encryptor; in both engagements the second attempt succeeded on hosts where the defense-evasion sequence executed without intervention.

A secondary stream of intelligence comes from an early May 2026 leak of the group''s internal database, which Huntress and Trend Micro independently reviewed. The leaked material confirms the existence of bespoke evasion utilities developed in-house — including a Defender-disabling helper that combines PowerShell, registry edits, and service stop primitives, and a logging-abuse module that targets the Windows Event Log service (EventLog) directly, both clearing existing logs and tampering with the log channel configuration to suppress future telemetry from specific Event IDs. The leak also exposed operator naming conventions for Scheduled Tasks (often masquerading as Microsoft or Windows Update tasks), preferred staging directories under C:\ProgramData and C:\Users\Public, and reusable PowerShell wrappers used to load encryptor components reflectively in memory.

Observed kill-chain. Initial access in the documented IRs has consistently come from valid remote-access credentials (VPN/RDP) acquired from initial access brokers, consistent with broader RaaS economics. Affiliates conduct discovery using built-in tools (whoami /all, net group /domain, nltest /dclist) and lightweight third-party scanners staged from C:\ProgramData. Privilege escalation is typically achieved by abusing already-acquired domain credentials rather than exploits, with lateral movement performed over SMB, WinRM, and PsExec-equivalent tooling. Persistence is overwhelmingly Scheduled Task-based: tasks are created under SYSTEM context with names that imitate legitimate Microsoft update or telemetry tasks (e.g., \Microsoft\Windows\UpdateOrchestrator\<random>). Defense evasion is where the operation is most distinctive — the group treats Event Log clearing, Defender tampering, and AV exclusion seeding as a single scripted sequence that runs immediately before encryptor staging.

Impact. Encryption is performed by a Windows PE encryptor that enumerates local fixed and network-mapped drives, terminates processes that hold open file handles on target paths (databases, mail stores, backup agents), and writes ransom notes into each impacted directory. Double extortion is standard: data is exfiltrated prior to encryption (typically via rclone or similar to attacker-controlled cloud storage) and victims who refuse to pay are listed on the group''s leak site. Recovery is generally limited to backup restoration as no public decryptor has been released.

Defender relevance. The April-May 2026 Huntress engagements show that this group''s playbook can be detected and disrupted at multiple choke points: (a) the wevtutil cl Security/System/Application sequence is itself an extremely high-fidelity behavioral signal, (b) Set-MpPreference -DisableRealtimeMonitoring $true and bulk AV exclusion additions are detectable via Defender''s own operational logs and via PowerShell ScriptBlock logging (Event ID 4104), (c) Scheduled Task creation under SYSTEM with names that imitate Microsoft tasks but launch PowerShell with encoded commands is observable via Event IDs 4698/4702 and Microsoft-Windows-TaskScheduler/Operational, and (d) the post-block re-run pattern (encryptor fails -> evasion sequence -> encryptor re-run) gives EDR and IR teams a documented detection window between the first failed encryption attempt and the second successful one.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1569.002 System Services: Service Execution
- T1078.002 Valid Accounts: Domain Accounts
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1685.005 Clear Windows Event Logs
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1003.001 OS Credential Dumping: LSASS Memory
- T1082 System Information Discovery
- T1482 Domain Trust Discovery
- T1069.002 Permission Groups Discovery: Domain Groups
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.006 Remote Services: Windows Remote Management
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs](https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1070.001 — Indicator Removal: Clear Windows Event Logs](https://attack.mitre.org/techniques/T1070/001/)
- [MITRE ATT&CK T1053.005 — Scheduled Task/Job: Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [Microsoft Defender Tamper Protection guidance](https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)
- [Ransomware.live — The Gentlemen victim listings](https://www.ransomware.live/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0555