Hackers Use Gentlemen Ransomware to Disable Windows Defender and Wipe Backups

A ransomware group known as The Gentlemen is using a combination of security tampering, service disruption and file encryption to make recovery more difficult for its victims.

The Windows strain of the malware can disable Microsoft Defender real-time protection, add broad exclusions that limit scanning, stop services related to backups and delete Volume Shadow Copies. Those actions weaken defenses and remove common recovery options after files are encrypted.

Beyond encrypting files, the malware also erases event logs and other system records that investigators rely on to reconstruct an incident.

The group operates a double-extortion model: attackers steal data in addition to encrypting it, increasing the risk of public exposure even when backups exist. The sequence of actions underlines that effective ransomware response requires protecting both production systems and recovery data.

These behaviors were documented by analysts in Acronis’ Threat Research Unit. In its technical analysis, Acronis describes The Gentlemen as a Go-based ransomware-as-a-service that surfaced in 2025 and targets Windows, Linux, network-attached storage and BSD systems.

Acronis reports the group has claimed more than 800 victims; that number reflects the group’s claims rather than independently verified infections.

On Windows hosts the ransomware attempts to turn off Defender’s real-time monitoring and add its own process and the C: drive to Defender’s exclusion list, reducing potential interference while it prepares to encrypt files. It also terminates selected processes and stops services associated with security products, databases, virtualization platforms, email systems and backup software.

Stopping database or virtualization services can free files for encryption, and interrupting backup software may block routine recovery tasks from running. Cyber Security News has previously reported on Gentlemen operators disabling defenses and backup services during intrusions.

Hackers use Gentlemen ransomware

Before encrypting files the malware attempts to remove available Volume Shadow Copies, which Windows can use to restore previous file versions. It also clears selected Windows logs, prefetch data and PowerShell command history, reducing the local evidence available to responders.

Acronis found the ransomware can establish persistence via scheduled tasks and startup registry entries. It searches for connected drives and, if configured, network shares. When the spreading option is enabled the malware can identify a domain and use PsExec to copy and execute itself on other workstations, extending the compromise across the network.

The encryption routine is designed for speed: files under 1 MB are encrypted entirely, while larger files may be encrypted in segments.

The ransomware uses ChaCha20 to encrypt file contents and elliptic-curve cryptography to protect file keys. Encrypted files are given an extension that can vary between builds, and the malware leaves a ransom note in affected folders.

Acronis also identified a separate EDR-killing tool that terminates security processes by dropping vulnerable drivers, installing them as services and using them to stop selected processes at the kernel level.

One of the drivers is associated with Safetica ProcessMonitorDriver and tied to CVE-2025-70795 in Acronis’ report; the other is Lenovo’s BootRepair.sys.

This method—often called “bring your own vulnerable driver”—lets attackers exploit a driver vulnerability to perform actions that normal user-level tools cannot. For context, similar techniques have been reported elsewhere where vulnerable drivers were used to neutralize endpoint detection and response (EDR) products.

Defenders should watch for signs such as unexpected changes to Defender settings, security or backup services stopping, unfamiliar driver installations, cleared logs and rapid file modifications across multiple systems.

Organizations should investigate

These events should be investigated collectively rather than treated as isolated alerts. Acronis recommends keeping endpoint detection active, promptly patching systems and drivers, limiting administrative privileges, monitoring PowerShell and remote administration usage, and segmenting networks to reduce lateral spread.

Backups must be tested regularly and protected with access controls that prevent a typical compromised system from deleting or altering them. Keeping critical backups offline or otherwise isolated from production systems preserves a recovery path if attackers obtain administrator privileges. Microsoft similarly advises restoring from verified offline or immutable backups after ransomware incidents.

These measures cannot stop every intrusion, but they reduce the risk that a single compromised device will cause a prolonged outage.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using [.] or hxxp://) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from 16K SOCs.