Ransomware groups have long followed a familiar playbook: break in, move laterally, exfiltrate data, and eventually deploy an encryptor. What distinguishes a ransomware-as-a-service operation researchers at Sophos have named “The Gentlemen” — tracked internally as GOLD SHERWOOD — is speed. Across a review of fifteen separate incidents, the median time from initial post-compromise activity to full network encryption was around two days. In the fastest case, the entire chain took under 24 hours.

Getting In the Door

The group doesn’t rely on novel zero-days to gain a foothold. Instead, its affiliates favor the tried-and-true weaknesses that persist across countless organizations: exposed firewall management interfaces, unpatched network appliances, and stolen VPN credentials. Fortinet SSL VPN accounts lacking multi-factor authentication came up repeatedly as an entry point, underscoring how a single missing MFA policy can become the crack an entire intrusion chain squeezes through.

A Methodical, Almost Corporate Approach to Compromise

Once inside, the operators move with discipline rather than smash-and-grab chaos. They lean on legitimate domain credentials and Remote Desktop Protocol to move laterally, then quietly change administrator passwords, add accounts to privileged groups, and open firewall rules that permit external RDP connections — effectively building themselves a durable back door alongside the front door they already used.

Defense evasion gets similar attention to detail. Sophos found the group staging its toolkit in trusted Windows file locations to blend in with legitimate system activity, then using a mix of custom and publicly available utilities to kill antivirus and EDR processes outright. Where security tooling resists, the operators have been observed loading vulnerable drivers to bypass protections at a lower level, and separately weakening Windows Defender through scan exclusions and policy changes rather than trying to disable it wholesale.

Killing Backups Before Pulling the Trigger

Perhaps the most damaging step in the chain comes just before encryption: the group systematically targets backup services and recovery agents, shutting them down so victims can’t simply restore from a snapshot once the ransomware runs. Windows event logs covering the Application, System, and Security channels are cleared in the same window, complicating any post-incident forensic reconstruction.

Data theft happens before the lock-up, not after. The group copies selected files using legitimate transfer tools, applying filters to prioritize newer data and reduce the volume moved — a practical choice that speeds up exfiltration and can help it slip past data-loss-prevention tooling tuned to catch bulk transfers. Sophos noted the group has adapted its exfiltration methods and object-storage destinations over time as defenses shifted, suggesting an operation that iterates based on what gets caught.

The Payoff: Double Extortion, Fast

Encryption itself can be triggered locally, pushed out across network shares, or delivered via domain logon scripts, giving affiliates flexibility depending on what access they’ve achieved. Encrypted files are marked with a six-character extension, and ransom notes are dropped throughout affected directories. In the cases Sophos reviewed, only the Windows variant of the encryptor was deployed, though related builds are known to support Linux and VMware ESXi environments — meaning virtualized infrastructure is very much in scope for future attacks.

With data already exfiltrated before encryption begins, victims face the now-standard double-extortion squeeze: pay to get a decryption key, pay to prevent a data leak, or both. As one Sophos researcher put it, “the findings show how a small window after a suspicious login can quickly become a business-wide outage.”

How to Blunt an Attack That Moves This Fast

Because the entire chain can complete in under a day, detection speed matters as much as detection accuracy. Sophos recommends organizations:

• Patch internet-facing firewalls and VPN appliances promptly, and enforce MFA on every remote-access account without exception.
• Restrict RDP exposure and monitor for newly opened firewall rules permitting external RDP access.
• Alert on unfamiliar data-transfer utilities, unexpected Windows Defender exclusions, and attempts to load unsigned or known-vulnerable drivers.
• Treat any disabling of backup or recovery-agent services as a high-severity incident, not routine noise.
• Assume that any suspicious login deserves an immediate response, since the window between initial access and full-blown encryption may be measured in hours rather than days.