Cet article présente les conclusions des chercheurs de la Counter Threat Unit™ (CTU) concernant le groupe de menace GOLD SHERWOOD et son opération ransomware-as-a-service (RaaS) The Gentlemen. L'analyse repose sur 15 intrusions distinctes investiguées par la CTU.

At a glance Malware family The Gentlemen ransomware (Go-based locker; Windows, Linux, ESXi builds) Threat actor GOLD SHERWOOD (confirmed by Sophos CTU) Targets Organizations across many sectors, worldwide; opportunistic victim selection Delivery vector Stolen VPN credentials and exposed firewall interfaces Key capabilities Rapid privilege escalation, BYOVD EDR killing, backup tampering, data theft Source Sophos Counter Threat Unit TL;DR The Gentlemen ransomware runs as a ransomware-as-a-service scheme under GOLD SHERWOOD.

CTU researchers found that GOLD SHERWOOD’s The Gentlemen RaaS uses a repeatable post-exploitation playbook with rapid privilege escalation, adaptive tool use, and strong defense evasion to deploy ransomware quickly after access. Affiliates rely on compromised credentials, legitimate tools, and exfiltration utilities like Rclone, Restic, and MinIO Client while targeting VPNs, firewalls, backups, and EDR defenses. #TheGentlemen #GOLDSHERWOOD #Rclone #Restic #Cloudflared