How can organisations defend against The Gentlemen?

How to disrupt The Gentlemen’s access and follow-on activity

The most effective defense starts before encryption begins: reduce exposed services, remove weak remote access paths, and assume the group will use valid credentials, lateral movement, and backup targeting once it gets in. Because ransomware crews often combine theft, encryption, and extortion, the objective is to narrow initial entry, contain movement, and make recovery reliable rather than merely restoring files.

Patch internet-facing systems quickly, especially where remote code execution or authentication flaws could be used as the entry point. Enforce multi-factor authentication on administrative access, separate privileged accounts from routine user activity, and ensure remote administration is limited to known management channels. Network segmentation matters because once an attacker reaches one host, flat networks make rapid spread and backup discovery much easier.

Recovery planning should assume the attacker will try to tamper with backups or disable tools before triggering encryption. Test offline recovery, not just backup completion, and verify that immutable or disconnected copies can be restored without using the same credentials that protect production. For broader ransomware tradecraft patterns and related actor behavior, see the Ransomware Groups Guide.

What to watch for once intrusion is suspected

Early warning signs usually appear in the execution and post-compromise phase, not at the moment of initial access. Sudden file renames, widespread encryption activity, disabled endpoint protections, unusual PowerShell or remote execution, and unexpected administrative logons are all consistent with hands-on-keyboard activity that is preparing the environment for ransomware.

Credential theft indicators deserve equal attention because ransomware operators frequently use stolen accounts to move quietly, reach backup systems, and stage mass deployment. Look for privileged logons from unfamiliar systems, sign-in patterns outside normal hours, new remote services, and changes to group membership or scheduled tasks that do not fit the usual administration baseline.

MITRE ATT&CK Enterprise Matrix is useful here because the relevant behaviors map cleanly to credential access, lateral movement, remote service use, and defense evasion.

Why recovery must be designed to survive hostile conditions

Ransomware resilience depends on whether recovery still works after the attacker has tried to break it. If backups are online, reachable from the same administrative plane, or protected by weak credentials, they are part of the attack surface. If restoration has never been tested under pressure, an organization may discover too late that the backup exists but cannot be trusted, mounted, or validated quickly enough to limit impact.

Good recovery design separates production administration from backup administration, keeps at least one recovery path offline or otherwise isolated, and verifies that restore points are clean before returning them to service. Where segmentation and zero trust principles are already part of the environment, they support the same objective: limit trust, limit reach, and make compromise of one account or subnet less likely to become full-domain or full-fleet encryption. NIST Cybersecurity Framework 2.0 and NIST SP 800-207 Zero Trust Architecture both reinforce that containment and recovery are core defensive outcomes, not afterthoughts.

Practitioner Guidance

What to prioritise: Focus first on internet-facing exposure, privileged access, and backup independence. If one compromised admin credential can reach production and backups, the environment is still vulnerable even if endpoint detections are strong.

What to verify: Confirm that administrative MFA is enforced, backup credentials are separate, and restoration has been tested from an offline or isolated copy. The important question is not whether backups exist, but whether they survive an attacker who already has foothold-level or privileged access.

Decision rule: If you can only complete one remediation sprint, remove or harden exposed remote services before tuning detections. Once the initial access path is narrowed, the rest of the response becomes much easier to contain and investigate.

Practitioner takeaway: Treat ransomware defense as a containment and recoverability problem, not just a malware detection problem, because the real failure mode is often the combination of valid access, lateral movement, and recoveries that were never isolated from the attacker.

Related resources from NHI Mgmt Group

• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?