Gentlemen ransomware disables Defender, deletes backups and spreads
Original title: Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups
AI summary · x-ai/grok-4.7Summaries by Vani AI
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
Acronis' Threat Research Unit says The Gentlemen, a Go-based ransomware-as-a-service operation that emerged in 2025, disables Microsoft Defender real-time protection, adds broad exclusions, stops security, database, virtual-machine, email and backup services, and deletes Volume Shadow Copies. It can clear logs, persist via scheduled tasks and startup registry entries, and, when enabled, copy itself with PsExec. A separate tool drops vulnerable drivers, including Safetica's ProcessMonitorDriver linked to CVE-2025-70795 and Lenovo's BootRepair.sys, to kill processes from kernel mode. The group uses double extortion; Acronis says it has claimed more than 800 victims.
Unconfirmed: The figure of more than 800 victims is the group's claim, not an independently confirmed count.
Key facts
- Files under 1 MB are fully encrypted; larger files may be encrypted in sections.
- Encryption uses ChaCha20, with elliptic-curve cryptography protecting file keys.
- Windows, Linux, network-attached storage and BSD are named targets.
- Acronis published multiple Windows SHA-256 indicators for the malware.
Security assessment · AI, from the articleExploited in the wild
Impact: File encryption, data theft and removal of local recovery copies
| Product | Affected |
|---|---|
| Safetica ProcessMonitorDriver | — |
| Lenovo BootRepair.sys | — |
What to do
- 1.Keep endpoint detection active and patch systems and drivers, including known vulnerable drivers.
- 2.Protect and test backups, including offline or immutable copies attackers cannot change.
- 3.Watch for Defender exclusions, stopped backup services, new drivers, log clearing and PsExec spread.
- CVEs
- CVE-2025-70795
- ATT&CK
- T1562.001 Disable or Modify ToolsT1490 Inhibit System RecoveryT1486 Data Encrypted for ImpactT1068 Exploitation for Privilege EscalationT1569.002 Service Execution
- Threat actors
- The Gentlemen
- Malware
- Gentlemen ransomware
- Organizations
- Acronis
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-70795 | STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that… | 5.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | smp10.simplex.im | ti2znn42i43bjdfd2prqqkad[.]onion/ Network SimpleX hxxps[://]smp10[.]simplex[.]im/a#Otp0TGDMNIj_QnXcvh9ABwFsiZEaZY_BovoanW59MXI Network X |
| domain | tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion | 667438c2dfe5c38cafdbba10defb Network Onion address hxxp[://]tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad[.]onion/ Network SimpleX hxxps[://]smp10[.]simplex[.]im/a#Otp0TGD |
| sha256 | 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f | compromise (IoCs):- Category Type Indicator Windows SHA-256 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f Windows SHA-256 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff |
| sha256 | 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 | 58ac951e6bac7636db5315b6d7e76c5a58b82b6b EDR killer SHA-256 143af42b492b0f36b296b0b593bd630248b5641c20b1ca1e5603e7e01b5b0676 EDR killer SHA-256 a1500204822fb16556a274132d802ba18a7e8b95 |
| sha256 | 228fc86acbaa6626051fd189932cb1768254aec5a9539771cee8a567103bbec1 | 7f234cb27678046f6c6b12aa7a072672f2a4694c2b9 Windows SHA-256 228fc86acbaa6626051fd189932cb1768254aec5a9539771cee8a567103bbec1 Windows SHA-256 9c6f6c0d7127c95aa1360ad6fb0ba5679527a6ea2cc |
| sha256 | 363a435e517f344056c42f8d46ef73396220f79e780828ad35ec0a68e7525d02 | bbc03f1fb5b82af8ebdf4b2be0ba1a70d59ac74b313 Windows SHA-256 363a435e517f344056c42f8d46ef73396220f79e780828ad35ec0a68e7525d02 Windows SHA-256 cd66fb941e63ad9a72687cafb050ed5b4d8b97b3446 |
| sha256 | 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 | fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f Windows SHA-256 3c2466d8a4572c26530e6f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 Windows SHA-256 586459f1adf018de4586dcd61782839a3ee72d84699 |
| sha256 | 403187f08c064f244e101bbc03f1fb5b82af8ebdf4b2be0ba1a70d59ac74b313 | 23d617062908c9d8c5aff9fed8361a5a74dc0d1af75 Windows SHA-256 403187f08c064f244e101bbc03f1fb5b82af8ebdf4b2be0ba1a70d59ac74b313 Windows SHA-256 363a435e517f344056c42f8d46ef73396220f79e780 |
| sha256 | 4de88220ff6a6dcb137b17d8d3f77ab4bacc39ea4e4d1147f687b021b7a82b8c | b8369b7332ada40c50070a9a3cd8e80ec89b19c48dc Windows SHA-256 4de88220ff6a6dcb137b17d8d3f77ab4bacc39ea4e4d1147f687b021b7a82b8c Windows SHA-256 afc30b1a14f2f29572412ba883782eb3ad3a9e6bf9f |
| sha256 | 5206a05eb128ccdef497f7f234cb27678046f6c6b12aa7a072672f2a4694c2b9 | cd61782839a3ee72d8469944e0f4dd45a6e20598869 Windows SHA-256 5206a05eb128ccdef497f7f234cb27678046f6c6b12aa7a072672f2a4694c2b9 Windows SHA-256 228fc86acbaa6626051fd189932cb1768254aec5a95 |
| sha256 | 586459f1adf018de4586dcd61782839a3ee72d8469944e0f4dd45a6e20598869 | f6bcef01fc1baefb98dbff2c65efaed5599622f51f3 Windows SHA-256 586459f1adf018de4586dcd61782839a3ee72d8469944e0f4dd45a6e20598869 Windows SHA-256 5206a05eb128ccdef497f7f234cb27678046f6c6b12 |
| sha256 | 6a70824fc1777f81c8e8289258ac951e6bac7636db5315b6d7e76c5a58b82b6b | 8023fe5d243b1b9f7e04b95127c506b6aae824c9d09 Windows SHA-256 6a70824fc1777f81c8e8289258ac951e6bac7636db5315b6d7e76c5a58b82b6b EDR killer SHA-256 143af42b492b0f36b296b0b593bd630248b5641c |
| sha256 | 7284d45bdbb1e32e3fb1ca6041b448b165795c91a2748de715798238fc8b3bff | cb3370008355435d9f022232870f3c27d29be8be60c Windows SHA-256 7284d45bdbb1e32e3fb1ca6041b448b165795c91a2748de715798238fc8b3bff Windows SHA-256 bd5950d4bd3de1c6d1609b8369b7332ada40c50070a |
| sha256 | 7d90023d535096da99bffcb3370008355435d9f022232870f3c27d29be8be60c | cafb050ed5b4d8b97b34461168581c4f150d6501523 Windows SHA-256 7d90023d535096da99bffcb3370008355435d9f022232870f3c27d29be8be60c Windows SHA-256 7284d45bdbb1e32e3fb1ca6041b448b165795c91a27 |
| sha256 | 7eb2fd5e79e79c3f2a95023d617062908c9d8c5aff9fed8361a5a74dc0d1af75 | d546dc51f9d5ef78c5ee56805906ec642dfa77a1c70 Windows SHA-256 7eb2fd5e79e79c3f2a95023d617062908c9d8c5aff9fed8361a5a74dc0d1af75 Windows SHA-256 403187f08c064f244e101bbc03f1fb5b82af8ebdf4b |
| sha256 | 9c6f6c0d7127c95aa1360ad6fb0ba5679527a6ea2cc17eb0bc2162dd1e13cd09 | 189932cb1768254aec5a9539771cee8a567103bbec1 Windows SHA-256 9c6f6c0d7127c95aa1360ad6fb0ba5679527a6ea2cc17eb0bc2162dd1e13cd09 Windows SHA-256 dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56 |
| sha256 | a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81 | 93bd630248b5641c20b1ca1e5603e7e01b5b0676 EDR killer SHA-256 a1500204822fb16556a274132d802ba18a7e8b95cf134bd17b473f915e8cda81 Vulnerable driver SHA-256 a974a9f097bc2e26f285560f1454c7071 |
| sha256 | a974a9f097bc2e26f285560f1454c70710c88c30c0ae1edfa2977ad862c56716 | 18a7e8b95cf134bd17b473f915e8cda81 Vulnerable driver SHA-256 a974a9f097bc2e26f285560f1454c70710c88c30c0ae1edfa2977ad862c56716 Vulnerable driver SHA-256 dfdc8313921c0f594ee1cd41ff7ef73d9 |
| sha256 | afc30b1a14f2f29572412ba883782eb3ad3a9e6bf9ff9c38aa48ff35a4ee73fa | 7d8d3f77ab4bacc39ea4e4d1147f687b021b7a82b8c Windows SHA-256 afc30b1a14f2f29572412ba883782eb3ad3a9e6bf9ff9c38aa48ff35a4ee73fa Windows SHA-256 f483faa2b9c9815a0efb08023fe5d243b1b9f7e04b9 |
| sha256 | bd5950d4bd3de1c6d1609b8369b7332ada40c50070a9a3cd8e80ec89b19c48dc | a6041b448b165795c91a2748de715798238fc8b3bff Windows SHA-256 bd5950d4bd3de1c6d1609b8369b7332ada40c50070a9a3cd8e80ec89b19c48dc Windows SHA-256 4de88220ff6a6dcb137b17d8d3f77ab4bacc39ea4e4 |
| sha256 | cd66fb941e63ad9a72687cafb050ed5b4d8b97b34461168581c4f150d6501523 | f8d46ef73396220f79e780828ad35ec0a68e7525d02 Windows SHA-256 cd66fb941e63ad9a72687cafb050ed5b4d8b97b34461168581c4f150d6501523 Windows SHA-256 7d90023d535096da99bffcb3370008355435d9f0222 |
| sha256 | dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70 | ad6fb0ba5679527a6ea2cc17eb0bc2162dd1e13cd09 Windows SHA-256 dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70 Windows SHA-256 7eb2fd5e79e79c3f2a95023d617062908c9d8c5aff9 |
| sha256 | dfdc8313921c0f594ee1cd41ff7ef73d973c667438c2dfe5c38cafdbba10defb | 710c88c30c0ae1edfa2977ad862c56716 Vulnerable driver SHA-256 dfdc8313921c0f594ee1cd41ff7ef73d973c667438c2dfe5c38cafdbba10defb Network Onion address hxxp[://]tezwsse5czllksjb7cwp65rvnk4o |
| sha256 | f483faa2b9c9815a0efb08023fe5d243b1b9f7e04b95127c506b6aae824c9d09 | ba883782eb3ad3a9e6bf9ff9c38aa48ff35a4ee73fa Windows SHA-256 f483faa2b9c9815a0efb08023fe5d243b1b9f7e04b95127c506b6aae824c9d09 Windows SHA-256 6a70824fc1777f81c8e8289258ac951e6bac7636db5 |
From the original article
4 min read at cybersecuritynews.com
A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for affected organizations. Its Windows malware can turn off Microsoft Defender’s real-time protection, add broad exclusions that reduce scanning, stop backup-related services and delete Volume Shadow Copies. These steps weaken defenses and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.