01-09-2026
Ungentlemanly behavior: Insights into a ransomware operation
https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation
Report completeness: Medium
Actors/Campaigns:
Gentlemen_ransomware (motivation: financially_motivated, cyber_criminal)
Gold_sherwood (motivation: financially_motivated)
Threats:
Gentlemen_ransomware
Edr-killer
Credential_harvesting_technique
Credential_dumping_technique
Mimikatz_tool
Cloudflared_tool
Centrastage_tool
Megasync_tool
Rclone_tool
Restic_tool
Byovd_technique
Gentlekiller
Havoc
Victims:
Organizations
Geo:
Netherlands
CVEs:
CVE-2024-55591 [Vulners]
CVSS V3.1: 9.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- fortinet fortiproxy (<7.0.20, <7.2.13)
- fortinet fortios (<7.0.17)
TTPs:
Tactics: 7
Technics: 0
IOCs:
File: 16
Registry: 4
Command: 7
Path: 2
Hash: 20
Soft:
FortiGate, SoftPerfect Network Scanner, Local Security Authority, Windows service, MinIO, Windows Defender, Linux, PsExec
Algorithms:
md5, sha1, sha256
Functions:
ESET
Languages:
powershell, golang
Links:
https://github.com/BlackSnufkin/BYOVD/tree/main/Xkpsm-Killer