HYDRA Threat Brief — "The Gentlemen" Ransomware (RaaS)

Executive summary

The Gentlemen is a Russian-speaking RaaS operation that emerged mid-2025 and went RaaS in September 2025. It is run by the actor hastalamuerte (aka zeta88), tracked as LARVA-368 (PRODAFT) and Storm-2697 (Microsoft) — a former Qilin affiliate who split after a July 2025 payment dispute (~$48K unpaid commission, aired publicly on the RAMP forum).

320+ victims on the public leak site — but Check Point found a SystemBC C2 holding 1,570+ compromised networks not yet public. Real scale far exceeds the leak site.
Double extortion, a Go-based self-propagating encryptor (Curve25519 + XChaCha20), multi-platform (Windows / Linux / NAS / BSD / ESXi).
OT-heavy, critical-sector focus: energy, government, healthcare, education, transport, finance, manufacturing — 20+ industries, 15+ countries.
The hunters got hunted — the operation itself was breached and its internal chats leaked, revealing ~78% of victims paid and never appeared on any public list.

1,570+

Networks (hidden C2)

~78%

Victims paid

20+

Industries hit

90%

Affiliate cut offered

Attribution & origins

Attribute	Detail
Primary alias	`hastalamuerte` / `zeta88`
Cluster tracking	LARVA-368 (PRODAFT Phantom Mantis) · Storm-2697 (Microsoft)
Origin	Russian-speaking; ran affiliate crew "ArmCorp" inside Qilin RaaS
Split catalyst	22 Jul 2025 RAMP arbitration vs Qilin — ~$48,000 unpaid commission
Emergence	Closed crew mid-2025 → RaaS Sept 2025; recruits via BreachForums
OPSEC irony	The operation itself was hacked and leaked; internal chats exposed

Notable: Group-IB found the operator uploaded an independent locker 5 days before the public Qilin arbitration — i.e. was building The Gentlemen while still a Qilin affiliate. A premeditated exit, not a reactive one.

Scale & victimology

Public leak site: 320+ victims since July 2025.
Hidden scale: a SystemBC C2 surfaced 1,570+ compromised networks not on any leak site — "significantly larger than what's publicly known, and still growing" (Check Point Research).
Payment rate: leak analysis → ~78% of victims paid and were never listed (silent extortion).
Sectors: disproportionately OT-heavy / high-downtime-cost verticals where restore-pressure is highest.
Geography: 15+ countries across the Americas, EMEA and Asia-Pacific. Named victim geos include the US, UK, Germany, Australia and Romania.

⚠ Supply-chain pivot — chain victimization

Apr 2026: the group breached a UK software consultancy, then reused stolen credentials + infrastructure docs + client-access info to compromise one of that consultancy's clients in Türkiye. Treat any hit on an MSP or consultancy as a downstream blast-radius event.

Attack lifecycle & TTPs

Stage	Observed
Initial access	Internet-facing services / stolen creds — exposed firewall & VPN management (FortiGate) 🎯
Discovery	`1.bat` enumerating 60+ domain accounts; Advanced IP Scanner, Nmap, AD + virtualization-group queries (VMware)
Priv-esc	`PowerRun.exe` — UAC bypass, run as SYSTEM
Defense evasion	BYOVD: `ThrottleBlood.sys` (abuses signed ThrottleStop driver) for kernel-level kill of security tools; PowerShell blinds Defender, re-enables SMB1, loosens LSA — then drops the payload
Lateral / persist	PsExec, AnyDesk; GPO abuse to push payloads domain-wide; self-propagating encryptor
C2	SystemBC (SOCKS5, RC4), Cobalt Strike, AnyDesk
Impact	Data theft before encryption → double extortion; ESXi variant kills VMs, inhibits recovery

Signature strength = tailored defense evasion — they iteratively fingerprint the victim's specific security stack and swap tooling when blocked.

The Go encryptor (Microsoft deep-dive)

Language: Go, obfuscated with Garble; variants for Windows / Linux / NAS / BSD / ESXi.
Crypto: per-file ephemeral Curve25519 keys + XChaCha20 stream cipher; partial-encryption speed tiers for large files.
Self-propagation: built in — --spread <domain/user:password>, falls back to the current session token.
Operator auth: requires a build-specific --password (analyzed sample: 9VoAvR7G).
Key flags: --full (→ --system + --shares), --fast/--superfast/--ultrafast (coverage vs speed), --wipe, --keep, --silent.
Host artifacts: scheduled task gentlemen_system; env var LOCKER_BACKGROUND=1; branded PowerShell console banner.

Indicators of compromise

Read this first

Public reporting lists no live/active C2 domains — these IOCs are retro-hunt grade (historical). Best used for threat-hunting and detection-engineering, not live blocklists. Hashes are build-specific; the group recompiles.

Type	Value	Note
MD5	`adf675ffc1acb357f2d9f1a94e016f52`	Gentlemen sample
MD5	`de1a114a2c5552387a1bbb61501bf129`	Gentlemen sample
Filename	`1.bat`	mass account enum (60+)
Loader	`All.exe`	defense-evasion loader
Driver	`ThrottleBlood.sys`	BYOVD (ThrottleStop abuse)
Tool	`PowerRun.exe`	UAC bypass / priv-esc
Sched task	`gentlemen_system`	SYSTEM re-exec
Env var	`LOCKER_BACKGROUND=1`	background worker flag
C2 / proxy	`SystemBC`, `Cobalt Strike`	SOCKS5 / RC4

Full structured IOC sets, ATT&CK mappings and Sigma rules: Microsoft Defender IOCs + hunting queries, SOC Prime Sigma rules, Trend Micro appendix.

Defender playbook — mitigation (priority order)

MFA + patch on all internet-facing edge — get FortiGate/VPN management off the public internet. This is the front door. 🎯
Vulnerable-driver blocklist (Microsoft HVCI / WDAC) to kill BYOVD (ThrottleStop/ThrottleBlood.sys).
EDR tamper-protection ON; alert on AV-disable attempts.
Keep SMB1 disabled; harden LSA (anonymous access locked, RunAsPPL).
Restrict / monitor PsExec, AnyDesk, Advanced IP Scanner on servers.
GPO change monitoring + least-privilege on GPO-edit rights.
Offline / immutable backups + tested restore (ESXi-inclusive); protect vCenter/ESXi.
Treat a hit on any MSP / consultancy as a downstream supply-chain event — rotate creds for their clients.

Why this matters for CZ / EU

Exposed FortiGate / VPN management is the recurring initial-access door — a concrete reason to look at your perimeter from the outside, the way an attacker does.
Romania is a confirmed victim geo (Check Point) — Central & Eastern Europe is in scope, not theoretical.
Target sectors — energy, healthcare, finance, government, OT — are exactly the NIS2 / DORA-regulated verticals. The question every board should ask: are we exposed to a currently-active, top-tier actor?

Sources & confidence

Primary / authoritative, all publicly published: Microsoft Security Blog (Go-encryptor deep-dive), Trend Micro ("Unmasking The Gentlemen"), Check Point Research / The Hacker News (SystemBC C2, 1,570+ networks, ESXi variant), Group-IB (attribution), Halcyon / Analyst1 (Qilin split, RAMP arbitration), FortiGuard, SOC Prime (detection rules). Supporting: SOCRadar, Cybereason, S-RM, CSO Online, Dark Reading, TechNadu, Cyberpress, Huntress.

🟢 HIGH — attribution, core TTPs, encryptor design 🟡 MEDIUM — exact victim count, 78% payment rate (leak-derived) 🔴 RETRO-HUNT ONLY — IOC hashes (build-specific, no live C2)

HYDRA discipline

Every claim traces to a named public source; anything inferred is flagged. No fabricated IOCs. This is passive OSINT on a documented adversary — no active engagement. We produce the same rigor on your exposure. The first finding is free.

Want to know if you're exposed to an active actor?

We map your external perimeter the way an attacker does — passive, evidence-first, closed-loop remediation. The first finding is free.

Talk to us → See a sample report

"The Gentlemen" — the RaaS that scaled faster than almost anyone.

Want to know if you're exposed to an active actor?