The Rise and Evolution of GOLD SHERWOOD
The Gentlemen RaaS infrastructure represents a significant evolution in the ransomware landscape. Following its launch in mid-2025, the group sought to scale its operations by aggressively recruiting affiliates on underground forums like RAMP, offering a generous 90/10 ransom revenue split—an incentive structure designed to attract experienced operators from other defunct or declining schemes.
The scale of the operation is evidenced by the rapid growth of the group’s victim leak site. In September 2025, the site saw minimal activity, with fewer than 20 victim names posted monthly. However, the first quarter of 2026 marked a strategic pivot in operational tempo. By January 2026, the volume of victim disclosures climbed significantly, culminating in a surge by mid-year. July 2026 proved to be the most prolific month in the group’s short history, with 169 victims listed. To date, 683 organizations across a diverse array of global sectors have been targeted, confirming that the group’s victimology is opportunistic rather than targeted toward specific industries.
The Anatomy of an Intrusion: TTPs and Operational Methodology
Sophos analysts, having investigated 15 distinct incidents, have pieced together the TTPs (Tactics, Techniques, and Procedures) that define The Gentlemen’s operational life cycle. The group’s methodology is characterized by a "low-and-slow" approach to persistence coupled with "fast-and-furious" execution during the final stages of the attack.
Initial access is frequently achieved through the exploitation of internet-facing vulnerabilities, particularly within firewall and VPN infrastructure. Forensic artifacts suggest that affiliates actively scan for unpatched FortiGate firewall management interfaces, specifically targeting CVE-2024-55591. In instances where vulnerabilities are not present, the group relies on brute-forcing or utilizing valid credentials purchased from initial access brokers. A notable February 2026 incident underscored the critical nature of multi-factor authentication (MFA); the threat actors gained entry via an unprotected Fortinet SSL VPN, immediately establishing redundant, foreign-based sessions to solidify their foothold before beginning internal reconnaissance.
Once inside the perimeter, the attackers prioritize lateral movement using Remote Desktop Protocol (RDP). By rapidly authenticating against domain controllers and file servers with stolen credentials, they effectively map the network’s critical infrastructure. A hallmark of their staging phase is the misuse of the C:PerfLogs directory. By hiding malicious binaries—including data exfiltration tools, credential dumpers, and EDR-killing utilities—within this legitimate Windows system folder, the attackers effectively bypass standard directory-based security scrutiny.
Sophisticated Exfiltration and Tooling
The Gentlemen’s approach to data theft is marked by an adaptive, multi-stage strategy. Rather than relying on a single exfiltration tool, affiliates deploy a variety of utilities including Rclone, Restic, and the MinIO Client (mc). Forensic analysis reveals that attackers often start with Rclone for high-speed data transfer, then pivot to Restic for more granular, iterative backups, and finally utilize MinIO for object storage uploads. This flexibility allows them to optimize data volume and transfer speeds based on the specific constraints of the victim’s environment, such as available bandwidth or existing security monitoring.
The group’s "EDR-killing" framework is perhaps its most aggressive defensive evasion tactic. Utilizing the "Bring Your Own Vulnerable Driver" (BYOVD) technique, affiliates deploy a suite of custom tools, which researchers have dubbed "GentleKiller." These tools abuse signed, legitimate drivers to terminate security processes at the kernel level. During these operations, the attackers also employ PowerShell scripts to modify Windows Defender settings, creating exclusions for their malicious directories and processes to ensure the encryption locker remains undetected during its execution.
The Role of Persistence and Anti-Forensics
Persistence is maintained through several channels, including the installation of Cloudflared agents as Windows services and the modification of registry keys to enable RDP at the system level. These methods provide the threat actors with multiple, resilient remote access paths that remain functional even if the primary VPN access is severed.
Once the desired data has been harvested and the environment prepared, the group engages in systematic anti-forensic activities. Before launching the ransomware, affiliates disable backup and recovery services to prevent the victim from restoring systems from offsite or cloud-based repositories. Additionally, they frequently clear the Application, System, and Security logs. This final act of destruction is designed to hinder incident response efforts, as it eliminates the forensic breadcrumbs—such as authentication events and service execution histories—required for a thorough root-cause analysis.
The Impact of Double Extortion
The double-extortion model employed by The Gentlemen places victim organizations in a precarious position. By stealing sensitive data prior to encryption, the group creates two distinct pressure points: the immediate loss of business continuity due to encrypted systems, and the long-term risk of regulatory fines, reputational damage, and intellectual property theft.
The ransom notes, titled "README-GENTLEMEN.txt," are standard in their delivery, yet the rapid deployment cycle—often occurring within 48 hours of initial access—leaves IT teams with little time to react. The median dwell time of two days highlights the urgency for organizations to transition from reactive security to proactive, automated threat hunting.
Strategic Recommendations and Defensive Posture
The operational efficiency of GOLD SHERWOOD necessitates a robust defensive posture that extends beyond traditional perimeter protection. Security researchers recommend the following hardening measures:
- Remote Access Hardening: Organizations must enforce strict MFA for all VPN and remote access services. Given the group’s reliance on compromised VPN credentials, the implementation of FIDO2-compliant hardware keys is recommended.
- Administrative Oversight: Administrative accounts should be monitored for anomalous behavior. Any unauthorized changes to domain group memberships or the addition of new accounts to the local Administrators group should trigger an immediate security alert.
- Staging Directory Monitoring: IT and security teams should implement monitoring for suspicious process execution originating from directories typically ignored by security tools, such as
C:PerfLogsand various temp folders. - Backup Resilience: Backup platforms must be isolated from the broader network where possible. Service configuration changes that attempt to disable backup agents should be blocked by EDR/XDR policies.
- Vulnerability Management: Given the group’s focus on firewalls and VPN appliances, rigorous patch management for internet-facing hardware is the first line of defense.
As the RaaS ecosystem continues to mature, groups like GOLD SHERWOOD are likely to refine their toolsets further, potentially adopting even more sophisticated EDR-evasion techniques. The shift from a dozen victims per month to nearly 170 suggests that The Gentlemen has successfully established a scalable "business" model. Organizations that fail to address these fundamental security gaps remain prime targets for a threat that continues to demonstrate that it can bypass legacy defenses with minimal effort and maximum impact. The ongoing analysis of these incidents serves as a stark reminder that in the modern ransomware economy, the speed of defense must consistently outpace the speed of the attacker.
