Ungentlemanly behavior: Insights into a ransomware operation

They call themselves The Gentlemen 🎩

Behind the name is one of the most active ransomware operations of the past 12 months, linked to 683 victims and a playbook built around compromised credentials, legitimate tools, rapid privilege escalation, and aggressive defense evasion.

In this video, Susie Evershed and Rafe Pilling break down the latest research from Sophos Counter Threat Unit (CTU), revealing how some affiliates can move from initial compromise to ransomware deployment in less than 24 hours.

Watch now to learn how The Gentlemen operate, the techniques they use to evade detection, and what defenders can do to disrupt attacks before ransomware is deployed.

Learn more: https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation