Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups

A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for affected organizations.

Its Windows malware can turn off Microsoft Defender’s real-time protection, add broad exclusions that reduce scanning, stop backup-related services and delete Volume Shadow Copies. These steps weaken defenses and remove common ways to restore files after encryption.

The malware also targets more than files. It can clear event logs and other system records that investigators may need to understand what happened.

The group uses a double-extortion model: attackers can steal data as well as encrypt it, raising the risk of public exposure even when a victim has backups. The sequence is a reminder that a successful ransomware response depends on protecting both systems and recovery data.

Analysts from Acronis’ Threat Research Unit identified these behaviors in its technical analysis of The Gentlemen ransomware and associated tools. The report describes a Go-based ransomware-as-a-service operation that emerged in 2025 and targets Windows, Linux, network-attached storage and BSD systems.

Acronis says the group has claimed more than 800 victims, though that figure reflects the group’s claims rather than independently confirmed infections.

On Windows, the ransomware attempts to disable Defender’s real-time monitoring and add its process and the C: drive to the exclusion list.

That may allow the malware to run with less interference while it prepares to encrypt files. It also stops selected processes and services linked to security tools, databases, virtual machines, email and backup products.

Cyber Security News has previously covered how Gentlemen operators disable defenses and backup services during intrusions.

The impact is not limited to security software. Stopping database or virtualization services can free files for encryption, while disrupting backup software may prevent routine recovery jobs from running.

Hackers Use Gentlemen Ransomware

Before encryption, the malware also attempts to remove available Volume Shadow Copies, which Windows can use to restore earlier versions of files.

It can clear selected Windows logs, prefetch data and PowerShell command history, reducing the local evidence available to responders.

Acronis found that the ransomware can establish persistence through scheduled tasks and Windows startup registry entries. It can also search for connected drives and, when the relevant option is used, network shares.

With its spreading feature enabled, it can identify a domain and use PsExec to copy and run the ransomware on other workstations.

This behavior connects one compromised machine to broader network risk, a pattern also detailed in Cyber Security News’ coverage of Gentlemen ransomware spreading across networks.

The encryption process is designed to move quickly. The report says files under 1 MB are encrypted in full, while larger files may be encrypted in sections.

The malware uses ChaCha20 for file encryption and elliptic-curve cryptography to protect the file keys. Encrypted files receive an extension that can vary between builds, and the malware leaves a ransom note in affected folders.

Acronis also identified a separate tool used to terminate security processes. It drops vulnerable drivers, installs them as services and uses them to stop selected processes at the kernel level.

One driver is linked to Safetica ProcessMonitorDriver, associated in the report with CVE-2025-70795; the other is Lenovo’s BootRepair.sys.

The technique is known as “bring your own vulnerable driver”: attackers abuse a driver with a weakness to gain actions that ordinary user-level tools may not permit. For more context, see Cyber Security News’ report on vulnerable drivers used against EDR.

For defenders, the warning signs include unexpected Defender setting changes, security or backup services stopping, unfamiliar driver installations, log clearing and rapid file changes across multiple systems.

Organizations should investigate

Organizations should investigate these events together rather than as isolated alerts. Acronis recommends keeping endpoint detection tools active, patching systems and drivers, limiting administrative access, monitoring PowerShell and remote administration tools, and segmenting networks to restrict spread.

Backups should be regularly tested and protected with access controls that prevent ordinary compromised systems from deleting or changing them.

Keeping critical copies offline or isolated from production can preserve a recovery path if attackers reach administrator accounts. Microsoft likewise advises restoring from verified offline or immutable backups after ransomware incidents.

These measures cannot prevent every intrusion, but they can reduce the chance that one compromised device turns into a prolonged outage.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups appeared first on Cyber Security News.