Check for Gentlemen Ransomware signs that block recovery and delete logs

Organisations using Windows, Linux, BSD and network-attached storage face increased risk from The Gentlemen ransomware operation. This group targets both systems and recovery data, aiming to block standard restoration methods. Affected users may find their files encrypted and their backups destroyed, leaving them with limited options for recovering lost information without paying a ransom or using offline copies.

How does the malware block recovery efforts?

The Gentlemen ransomware actively disables Microsoft Defender’s real-time protection on Windows systems. It adds broad exclusions that reduce scanning effectiveness and stops services linked to backup products. By deleting Volume Shadow Copies, the malware removes a common method for restoring earlier versions of files. These actions significantly weaken defences and eliminate routine recovery paths, forcing victims to rely on isolated, offline backups if they have them.

What data is at risk of exposure?

The group employs a double-extortion model, meaning attackers steal data before encrypting it. This raises the risk of public exposure even if an organisation has intact backups. The malware can target databases, virtual machines and email systems, freeing files for encryption. Clearing event logs and PowerShell command history further complicates investigations, as it reduces the local evidence available to security teams trying to understand the scope of the breach and the data taken.

Which systems are targeted by this operation?

Analysts from Acronis’ Threat Research Unit identified the ransomware as a Go-based operation. It emerged in 2025 and targets a wide range of platforms. These include Windows, Linux, BSD systems and network-attached storage devices. The malware attempts to establish persistence through scheduled tasks and Windows startup registry entries. This broad targeting capability means that organisations relying on diverse infrastructure must ensure their security measures cover all supported operating systems, not just Windows environments.

How widespread are the claimed infections?

Acronis states that The Gentlemen group has claimed more than 800 victims. However, this figure reflects the group’s own claims rather than independently confirmed infections. The actual number of affected organisations may be lower. The group’s technical analysis highlights the sophistication of the tool, which combines security tampering with service disruption. This approach suggests a focus on maximising pressure on victims by destroying evidence and blocking recovery, rather than just encrypting files.

What affected people can do

Teams should immediately verify the integrity of their offline backups. Check whether any recent system changes match known malware behaviour, such as disabled security services. Monitor for unusual process activity that might indicate the ransomware is running. Be wary of follow-up emails claiming to offer decryption tools, as these are often scams. Ensure that incident response plans include steps for isolating affected systems quickly. Regularly test backup restoration procedures to confirm they work when needed.

What to do and how to stay safe

• Managed detection services handle the 24/7 monitoring that small teams cannot sustain internally.
• Attack surface reduction rules block common execution paths before malware can activate.
• Delegating log analysis to vendors prevents alert fatigue and ensures consistent incident response.

Small businesses must delegate EDR monitoring to managed providers to ensure continuous protection without overwhelming internal staff. Audit your current endpoint security gaps and select a vendor that offers automated containment and clear reporting.

Step-by-step guide: Endpoint Detection and Response for Small Teams

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.