‘The Gentlemen’ Ransomware Targets Asia Pacific

A newly identified ransomware group is targeting victims across the Asia Pacific region using custom-built evasion capabilities that could pose a “significant threat” to organizations, warn researchers at security firm Trend Micro.

See Also: Preparing for the Next Attack

Trend Micro first spotted in August a ransomware campaign orchestrated by The Gentlemen, “an emerging and previously undocumented threat group.”

Unlike groups that rely on generic anti-virus evasion techniques, The Gentlemen deploys customized methods tailored to each target. “By adapting their tools mid-campaign, the attackers demonstrate versatility and determination, posing a significant threat to organizations regardless of their security defenses,” Trend Micro said.

The group has already attacked at least 17 organizations across the manufacturing, construction, healthcare and insurance sectors. Most cases have been recorded in Thailand but Trend Micro also identified targets in the United States.

Based on the victim count and the attack sophistication, Trend Micro researchers say The Gentlemen is likely a rebrand of a group of experienced operators, or the initiative of a well-funded cybercrime organization.

Analysis suggests attackers gain initial access by exploiting internet-facing services or using compromised credentials. In one case analyzed by the researchers, they uncovered a FortiGate server compromised by the hacker.

Once inside, the group employs reconnaissance tools such as Advanced IP Scanner to map networks and identify valuable targets. Attackers execute a batch script named 1.bat to scan the domain infrastructure.

As part of their customized evasion strategy, The Gentlemen operators assess endpoint protection mechanisms and adapt their methods accordingly. The group uses PowerRun.exe to disable or terminate security-related services and Allpatch2.exe, a custom tool designed to neutralize endpoint security agents.

The group deploys PsExec for lateral movement, which modifies authentication and remote access protocols to weaken defenses. The hackers also exploit group policy management tools gpmc.msc and gpme.msc to collectively manage applications to spread ransomware.

To avoid detection, the group deletes Windows Defender support files, remote desktop protocol artifacts and recycle bin content. In a final cleanup stage, the attackers dropped a self-named script that deleted both the ransomware binary and itself.

Trend Micro said the campaign reflects an evolution in ransomware operations, moving beyond the “one-size-fits-all” approach toward highly tailored attacks.

“These types of campaigns make detection, prevention and incident response significantly more challenging,” the firm warned.