The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

The Gentlemen ransomware operation is moving from access to full network encryption at striking speed. In some intrusions, attackers disabled defenses and recovery services before deploying ransomware in less than 24 hours across enterprises.

The group runs as a ransomware-as-a-service operation, meaning affiliates can strike organizations they can reach. Its double-extortion approach adds pressure: files are stolen first, then encrypted, leaving victims facing a data leak as well as operational disruption.

Analysts at Sophos examined 15 incidents linked to the group, tracked as GOLD SHERWOOD, and found a repeatable playbook.

The findings show how a small window after a suspicious login can quickly become a business-wide outage.

Sophos said in a report shared with Cyber Security News (CSN) that initial access appears to come from exposed firewall management interfaces, unpatched devices, or stolen VPN credentials.

A Fortinet SSL VPN account without multi-factor authentication gave the intruder a foothold, underlining why FortiOS authentication bypass vulnerability remains a serious concern for exposed infrastructure.

The Gentlemen Ransomware Hackers Disable EDR

Once inside, the affiliates moved across systems using legitimate domain credentials and Remote Desktop Protocol.

They placed their toolkit in a trusted Windows location that is often overlooked, then mapped systems, data stores, and backup infrastructure before the visible stage of the attack began.

They increased their control by changing administrator passwords, adding accounts to privileged groups, and enabling remote desktop access.

In several cases, they created firewall rules to allow outside RDP connections, providing a fallback route if the originally compromised VPN session was lost.

Next, they removed obstacles to encryption. Attackers used custom and publicly available utilities, including vulnerable drivers, to terminate antivirus and endpoint detection and response processes.

They also weakened Windows Defender by adding broad scan exclusions or changing policy settings. A recent report on ransomware operators disable EDR shows the broader pattern of crews stopping security and backup software before spreading across a network.

In this campaign, the effort was deliberate rather than incidental, with multiple approaches used when one method failed. Backup services were then disabled, often immediately before encryption.

They targeted recovery and backup-agent services, making it harder for teams to restore systems. In one intrusion, they also cleared Application, System, and Security event logs, obscuring the evidence responders need to trace the breach.

Rapid Encryption Playbook

Before locking systems, the group copied selected files with legitimate transfer tools. It commonly focused on newer data and used filters to reduce the volume transferred, which can make outbound activity less obvious while still collecting material valuable for extortion.

Affiliates adapted their process. Researchers saw them switch among transfer utilities and object-storage methods as conditions changed.

That flexibility resembles other attacks against remote infrastructure, including Gunra ransomware VPN attacks, where exposed access points can quickly lead to high-impact ransomware activity.

The median interval from first observed post-compromise activity to ransomware deployment was about two days. The shortest observed period was under 24 hours, leaving little room for manual investigation after an attacker gains entry.

The locker was deployed locally, through network shares, or across the domain using centralized logon shares and remote execution.

It encrypted files, assigned a six-character extension, and left a ransom note in affected directories. Although Windows was the only version deployed in the reviewed cases, related builds also support Linux and ESXi environments.

The pace makes prevention and early detection equally important. Organizations should patch internet-facing firewalls and VPN appliances, require MFA for every remote-access account, restrict RDP exposure, and closely review new privileged accounts. The Fortinet security update guidance provides useful context on fixing a flaw tied to the access methods investigated.

Teams should also alert on unusual activity from system staging folders, unfamiliar data-transfer utilities, Windows Defender exclusions, disabled backup services, cleared logs, and attempts to load vulnerable drivers.

Separating backups from ordinary administrator control and testing recovery plans can prevent attackers from turning a single compromised account into a prolonged outage.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.