The Gentlemen: The RaaS That Enters at the Edge and Neutralizes EDR

Among the ransomware operations that emerged in 2026, The Gentlemen stands out for its rate of growth and an industrialized playbook. Securelist, which has tracked this group since February 2026, places it among the ten most active actors by victims announced on its leak site in the first half of the year. What makes this case interesting for a defense team is less the group itself than the technical chain it runs, representative of what mid-sized companies face today: entry at the network edge, EDR neutralization, then encryption.

Initial access prepared in advance

The Gentlemen wastes no time on reconnaissance. The group relies on a carefully maintained database of roughly 14,700 already-compromised FortiGate devices and 969 brute-force-validated VPN credentials, which lets its affiliates skip the reconnaissance phase entirely and immediately access victim networks. Initial access therefore comes through exposed remote access services, T1133 (External Remote Services), via vulnerable edge appliances and weak or already-stolen credentials.

This approach has a direct consequence for defense: an organization whose FortiGate appears in such a database can be attacked without any prior reconnaissance activity being visible. Detection therefore cannot count on the usual noise of a scan. It must focus on the following stages, which leave far clearer traces.

EDR neutralization via vulnerable driver

The stage that deserves the most attention is defense evasion through the BYOVD technique, for Bring Your Own Vulnerable Driver. The Gentlemen affiliates load a legitimate but vulnerable driver, in this case ThrottleStop.sys renamed by the attackers, to exploit vulnerability CVE-2025-7771 and gain kernel-level code execution. From the kernel, they disable or blind the EDR. This is T1562.001 (Impair Defenses: Disable or Modify Tools), backed by T1543.003 (Create or Modify System Process: Windows Service) for loading the driver.

The stable detection point is the loading of the vulnerable driver itself. Windows logs a driver load in Sysmon Event ID 6, which includes the driver's hash and signature. A rule that watches for the loading of drivers known to be abused in BYOVD catches this stage before the EDR is disabled.

title: Known vulnerable driver load (BYOVD)
id: 7e1b3d92-4a08-4c65-9f2d-8b0e5c1a7f34
status: experimental
description: >
  Detects loading of a legitimate but vulnerable driver frequently abused to
  disable EDR, a pattern observed with The Gentlemen.
references:
  - https://securelist.com/the-gentlemen-raas/120447/
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - '\ThrottleStop.sys'
      - '\ThrottleBlood.sys'
  condition: selection
falsepositives:
  - Legitimate ThrottleStop use on overclocking machines, to document
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1543.003

AD reconnaissance and scheduled-task persistence

Once the EDR is neutralized, the group deploys SharpADWS to enumerate Active Directory via the directory web service, alongside tools like NetScan and Advanced IP Scanner to map the network. This enumeration falls under T1087.002 (Account Discovery: Domain Account). For persistence, an innocuously named scheduled task, such as UpdateUser, is created on hosts, technique T1053.005 (Scheduled Task). This task name is a valuable indicator, because it matches no legitimate Windows or common software task.

title: Persistence scheduled task named UpdateUser
id: 1f9c2a47-6b03-4e18-8d5a-2c7f0b9e4a61
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698
    TaskName|contains: 'UpdateUser'
  condition: selection
falsepositives:
  - To verify, no common legitimate task carries this name
level: high
tags:
  - attack.persistence
  - attack.t1053.005

The command and control channel

The Gentlemen also deploys a backdoor written in Go, using the Yamux multiplexer for its command and control channel. A YARA rule on suspect binaries can target the combination, unusual in a legitimate context on a production server, of a Go binary embedding the Yamux library and markers of file encryption functions.

rule Gentlemen_Go_Backdoor
{
    meta:
        description = "Detects a The Gentlemen style Go backdoor (Yamux multiplexer)"
        reference = "https://securelist.com/the-gentlemen-raas/120447/"
        author = "ThreatClaw"
    strings:
        $go = "Go build ID" ascii
        $yamux = "hashicorp/yamux" ascii
        $s1 = "session.OpenStream" ascii
    condition:
        uint16(0) == 0x5a4d and $go and $yamux and $s1
}

The lesson for a mid-sized company

This chain shows why endpoint protection alone no longer suffices: the group deliberately neutralizes it, ahead of encryption. Effective defense is layered. First, reduce the edge surface, by patching and hardening remote access appliances, since that is the entry point. Then detect the following stages, vulnerable driver load and suspicious scheduled task creation, with rules that work even when the EDR is blinded, relying on Windows event logs and an external collector. Detecting the BYOVD driver load is especially valuable because it happens just before visibility disappears.

Covering a full intrusion chain requires correlated rules on each of its stages. That is what the ThreatClaw Sigma feed provides: rules built on the techniques actually observed, from driver load to persistence, tested before release to stay operable over time.