A ransomware-as-a-service operation called The Gentlemen has built its attack chain around a simple but effective principle: cripple an organization’s defenses and its ability to recover before encrypting a single file. A new technical analysis from Acronis’ Threat Research Unit lays out exactly how far the group goes to make sure victims have no easy way back.

A methodical approach to sabotage

Written in Go, the Gentlemen malware targets a wide spread of platforms — Windows, Linux, network-attached storage devices, and BSD systems — and has been linked by Acronis to claims of more than 800 victims since the operation emerged in 2025. That figure comes from the group’s own leak-site claims rather than independent verification, but even discounted, it points to an active and prolific operation.

On Windows systems, the malware’s first moves are aimed squarely at the organization’s defenses rather than its files. It attempts to disable Microsoft Defender’s real-time protection outright and adds its own process, along with the entire C: drive, to Defender’s scan exclusion list — effectively asking the operating system’s built-in antivirus to look the other way while it operates. From there it works through a target list of processes and services tied to security software, databases, virtual machines, email platforms, and — critically — backup products.

Burning the escape routes

Stopping backup services isn’t incidental; it’s the point. By disrupting backup software before encryption begins, the malware prevents scheduled recovery jobs from completing successfully, removing one of the most reliable ways organizations recover from ransomware without paying. The malware goes further still, attempting to delete Volume Shadow Copies — the built-in Windows snapshots that let administrators roll a system back to an earlier state — which closes off another common, low-effort recovery path.

The group also works to limit what incident responders can reconstruct after the fact. According to Acronis, the malware clears selected Windows event logs, prefetch data, and PowerShell command history, stripping away much of the forensic trail that would normally help defenders understand how the intrusion unfolded.

Built to spread and built to persist

Gentlemen establishes persistence through scheduled tasks and Windows startup registry entries, and when its spreading feature is enabled, it can map a target’s Active Directory domain, locate network shares and additional workstations, and use the legitimate Windows administration tool PsExec to copy and execute itself across the network. That turns a single compromised endpoint into a foothold for a much broader outage.

Once encryption begins, the process is optimized for speed: files smaller than 1 MB are encrypted in their entirety, while larger files are encrypted in sections rather than in full, letting the malware churn through large data sets faster. File contents are locked with the ChaCha20 cipher, while the keys protecting those files are themselves secured using elliptic-curve cryptography — a combination intended to make the encryption itself resistant to brute-force recovery. The group operates a double-extortion model on top of this, meaning stolen data can be threatened with public exposure even for victims who manage to restore from backups.

A separate tool for killing security software

Acronis also identified a companion tool used specifically to terminate security processes at the kernel level, using a technique known as “bring your own vulnerable driver” (BYOVD). The tool installs a legitimate but flawed driver as a Windows service and then abuses that driver’s own vulnerability to perform actions ordinary user-level software isn’t permitted to take — in this case, forcibly killing protected security processes. One of the drivers involved is tied to Safetica’s ProcessMonitorDriver and a tracked flaw, CVE-2025-70795; the other is Lenovo’s BootRepair.sys. Because the drivers themselves are digitally signed by legitimate vendors, this approach can slip past controls that only check whether a driver’s signature is valid, rather than whether the driver has a known, exploitable weakness.

What defenders should watch for — and do

Acronis points to several early-warning signs that an intrusion is in progress before encryption actually starts: unexpected changes to Defender settings, security or backup services unexpectedly stopping, installation of unfamiliar drivers, event log clearing, and rapid file modifications spreading across multiple systems in a short window. Treating these as a connected sequence — rather than investigating each alert in isolation — gives defenders a better chance of intervening before encryption begins.

Recommended mitigations include keeping endpoint detection and response tools active and tamper-resistant, promptly patching both operating systems and third-party drivers, restricting administrative privileges, closely monitoring PowerShell and remote administration tool usage, and segmenting networks to limit lateral movement. Backups deserve particular attention: they should be tested regularly and protected with access controls that prevent a compromised standard account from modifying or deleting them, ideally by keeping critical copies offline or otherwise isolated from the production environment the ransomware can reach.