TheGentlemen Ransomware Decryption and Recovery

TheGentlemen typically gains initial access through compromised credentials, phishing, or exposed remote-access services that lack strong access controls. Trend Micro’s investigation also traced intrusion activity to a compromised FortiGate firewall account, and secondary analysis has reported exploitation of the FortiOS authentication-bypass vulnerability CVE-2024-55591 as an entry point.

Once inside, operators map the network with legitimate IT tools such as Advanced IP Scanner, enumerate accounts and administrative groups, and identify the specific security products in place. They then abuse Group Policy to push changes domain-wide, disabling endpoint protection, terminating security services, and modifying registry settings to weaken the environment.

To defeat endpoint detection, the group brings its own vulnerable signed drivers (a “bring your own vulnerable driver” technique) and runs custom tooling, including a utility Trend Micro identified as Allpatch2.exe, alongside PowerRun.exe to execute with SYSTEM-level privileges. With defences down, they move laterally to domain and enterprise administrator accounts, exfiltrate data over encrypted channels, and deploy the encryptor across enterprise systems and shared resources.