Verify Backup Integrity and Defender Settings if Gentlemen Ransomware Targets Your Network

The Gentlemen ransomware operation targets organizations by disabling security tools, disrupting backup services and encrypting files to hinder recovery efforts. This campaign affects organizations whose systems are compromised, leaving them with limited options to restore systems without paying the attackers. The malware specifically weakens defenses on Windows, Linux, network-attached storage and BSD systems, according to technical analysis.

Root cause

Acronis Threat Research Unit analysts identified the specific behaviors in their technical review of The Gentlemen ransomware. The group operates a Go-based ransomware-as-a-service model that emerged in 2025. The malware turns off Microsoft Defender real-time protection and adds broad exclusions to reduce scanning effectiveness. These actions allow the malware to operate with minimal interference from security software, according to the analysis.

Attack path

The malware executes a sequence of destructive actions before encrypting files. It stops selected processes and services linked to security tools, databases, virtual machines, email systems and backup products. By halting database or virtualization services, the malware may free files for encryption. Disrupting backup software may prevent routine recovery jobs from running. The malware also attempts to remove available Volume Shadow Copies, which Windows can use to restore earlier file versions.

Affected versions

The Gentlemen ransomware targets multiple operating systems and storage types. Affected platforms include:

• Windows systems, where Defender and shadow copies are specifically targeted
• Linux systems
• Network-attached storage devices
• BSD systems

Acronis states the group has claimed more than 800 victims, though this figure reflects attacker claims rather than independently confirmed infections. The malware establishes persistence through scheduled tasks and Windows startup registry entries.

Mitigation

• Monitor for unexpected changes to Microsoft Defender settings and exclusion lists
• Verify that backup services are running and not stopped by unauthorized processes
• Check for deleted Volume Shadow Copies and cleared event logs
• Review scheduled tasks and Windows registry entries for unknown persistence mechanisms
• Ensure security tools, databases and virtualization services remain active during operations

For customers and users

Affected users should verify that their backup systems are functioning correctly and not disabled. Check whether Microsoft Defender real-time protection is active and not added to exclusion lists. Look for signs of cleared event logs or missing shadow copies, which indicate tampering. Be alert for follow-up scams where attackers claim to offer recovery services. Teams usually recommend verifying system integrity through trusted channels and reporting suspicious activity to security personnel immediately.

Background: Real-time protection

Small businesses achieve effective real-time protection by combining endpoint detection, network traffic analysis, and strict access controls. You do not need enterprise budgets to deploy these measures. Focus on immediate threat blocking and automated response rather than manual review. This approach limits damage when human oversight is limited.

Read the full guide: Real-Time Protection for Small Business: Low-Cost Defense Strategies

What to do and how to stay safe: Gentlemen Ransomware

• Check your Windows Defender settings to ensure real-time protection is enabled and no broad exclusions exist
• Verify that your backup services are running and recent backups are intact and accessible
• Review system event logs for signs of tampering or unauthorized deletions
• Once the vendor provides an update, apply security patches promptly to address known vulnerabilities

Step-by-step guide: Offline Backup Mistakes That Break Ransomware Recovery

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What systems does The Gentlemen ransomware target?

The malware targets Windows, Linux, network-attached storage and BSD systems, according to Acronis analysts.

How does the malware prevent file recovery?

It disables Microsoft Defender, stops backup services, deletes Volume Shadow Copies and clears event logs to remove restoration options.

Has this ransomware been confirmed to infect specific organizations?

Acronis states the group has claimed more than 800 victims, but this figure reflects attacker claims rather than independently confirmed infections.