Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups

What happened?

A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for affected organizations. Its Windows malware can turn off Microsoft Defender’s real-time protection, add broad exclusions that reduce scanning, stop backup-related services and delete Volume Shadow Copies. These steps weaken defenses and remove common ways to restore files after encryption. The malware also targets more than files. It can clear event logs and other system records that investigators may need to understand what happened.

Key details

• It stops backup-related services and deletes Volume Shadow Copies to hinder file recovery.
• The ransomware spreads laterally across networks using PsExec to execute on other workstations.
• Encrypted files receive varying extensions and a ransom note is left in affected folders.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.