One infected computer could expose an entire network: CERT-In flags ‘The Gentlemen’ ransomware - Business Upturn
India's Computer Emergency Response Team (CERT-In) has flagged a ransomware operation called 'The Gentlemen' that can spread across entire networks from a single infected computer.
The ransomware operates through a Ransomware-as-a-Service (RaaS) model, allowing cybercriminal affiliates to deploy it in attacks. Its double-extortion strategy involves stealing sensitive information before encrypting files, with attackers threatening to publish stolen data if victims refuse to pay.
Network Propagation
The most concerning feature is the malware's ability to propagate across compromised networks using lateral movement techniques. This could significantly increase the scale of an incident, particularly in organizations with interconnected systems.
One infected computer could expose an entire network
Technical Details
The malware is reportedly developed using the Go programming language and employs Garble for code obfuscation, making it harder to analyze. It targets Windows, Linux, BSD, network-attached storage (NAS) devices and VMware ESXi environments.
Affected Sectors
Microsoft Threat Intelligence has associated the operation with attacks affecting organizations in education, transportation, healthcare and finance. CERT-In identifies healthcare, construction, finance and manufacturing as additional targeted sectors.
Mitigation Measures
Organizations are expected to review network security, restrict unnecessary access between systems, maintain offline backups and monitor unusual activity. CERT-In emphasizes early detection and limiting lateral movement to prevent further spread.
Related
