Ungentlemanly behavior: Insights into a ransomware operation

    Wednesday, September 2, 2026 In: Threat Research Print

    Date: 09/02/2026

    Severity: High

    Summary

    The Gentlemen ransomware-as-a-service (RaaS) operation, attributed to GOLD SHERWOOD, which uses stolen VPN credentials, vulnerable firewalls, and rapid privilege escalation to compromise organizations. Affiliates leverage RDP, Cloudflared tunnels, credential dumping, Rclone data exfiltration, BYOVD-based EDR killers, and backup tampering before deploying Go-based ransomware. The campaign follows a flexible double-extortion model, combining data theft, defense evasion, and rapid ransomware deployment. 

    Indicators of Compromise (IOC) List 

    Hash

    058c3ff21e79770e4a60937c27b1ede227709248

    9c0b05eb75f971cc25ee979e49b227b86b19e833

    a438ba2122a814320f47a056f04122f81c2ae6c5

    a8ba89e67297642dcc1ae77433ab84e1f27d1792

    a348f5fa048a09188bd706fd3d4efca978990caf3355ecfee501c9f1e19c0efd

    ddba5b4e7a7ada77d56477e9d41c008f93e81d9a33ed09e77cb2af624fa694fe

    1a9291ec869155336bf185d221d655d11c77a55ea0c8ecc0274202f74a90fcd1

    3c71537b64487bbf4d1793f72c75d332650d09a77b71e4d884ff15c266a847f6

    50f2cdf16f05da9253fa2d6eb60d5a42da14c02c551c0874c9e953d4119da69c

    bf7a2fb7f7256809dc690213b85f747cef8db7b909caf9783cac181912fb6207

    761ce72420edf5e5531cdbad0e93397d7520cdead825886ca7f75cef76031720

    81053c2c3be8b7dbf7d5087dba05c940b3ee4fd95524272651c816b72c5a9443

    7a37acb031cddaa39ad20db0961baa5423ec53f318c49c9275c982507da76d6a

    3a31ec3bf9b7eac6593a723145381f5d0f4ede076c4c8818d949a08f5596ff76

    68031d549de399a44bb00614b910106baccef5996623b2f1102352a52a5bb444

    0be8f415a485b11747bcfd71c9cd9781e090354728f076791ed6845b69ed78fb

    2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d

    Ccdde8091d63eaafbe30d9f0482afd245abc10ab16e21ae9254e51e42cb80ae8

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    sha1hash IN ("a8ba89e67297642dcc1ae77433ab84e1f27d1792","9c0b05eb75f971cc25ee979e49b227b86b19e833","a438ba2122a814320f47a056f04122f81c2ae6c5","058c3ff21e79770e4a60937c27b1ede227709248")

    Detection Query 2 :

    sha256hash IN ("2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d","3c71537b64487bbf4d1793f72c75d332650d09a77b71e4d884ff15c266a847f6","bf7a2fb7f7256809dc690213b85f747cef8db7b909caf9783cac181912fb6207","68031d549de399a44bb00614b910106baccef5996623b2f1102352a52a5bb444","1a9291ec869155336bf185d221d655d11c77a55ea0c8ecc0274202f74a90fcd1","ccdde8091d63eaafbe30d9f0482afd245abc10ab16e21ae9254e51e42cb80ae8","50f2cdf16f05da9253fa2d6eb60d5a42da14c02c551c0874c9e953d4119da69c","3a31ec3bf9b7eac6593a723145381f5d0f4ede076c4c8818d949a08f5596ff76","7a37acb031cddaa39ad20db0961baa5423ec53f318c49c9275c982507da76d6a","761ce72420edf5e5531cdbad0e93397d7520cdead825886ca7f75cef76031720","0be8f415a485b11747bcfd71c9cd9781e090354728f076791ed6845b69ed78fb","81053c2c3be8b7dbf7d5087dba05c940b3ee4fd95524272651c816b72c5a9443","a348f5fa048a09188bd706fd3d4efca978990caf3355ecfee501c9f1e19c0efd","ddba5b4e7a7ada77d56477e9d41c008f93e81d9a33ed09e77cb2af624fa694fe")

    Reference: 

    https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation              


    Tags

    MalwareThreat ActorRaaSRansomwareExfiltrationBYOVDExtortionCredential HarvestingVulnerabilityRDPCloudflareRcloneGolang

    « Previous Article

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.