RSS
Last updated: May 13, 2026 at 5:42 AM UTC
All 208 Vulnerability 72 Breach 41 Threat 88 Defense 7
Tag: lateral-movement (2 articles)Clear
threat
2026-04-21

The Gentlemen ransomware operation hiding 1,570+ unreported victims per Check Point C2 analysis - 5x larger than leak site suggests

Check Point researchers gained visibility into a SystemBC command-and-control server used by an affiliate of The Gentlemen ransomware-as-a-service operation and found over 1,570 compromised corporate networks that have not been publicly disclosed. The group's own data leak site only lists about 320 victims, meaning the real footprint is nearly 5x larger than public reporting suggests. The Gentlemen emerged in July 2025 and has become one of the most prolific RaaS operations. It uses a Go-based locker targeting Windows, Linux, NAS, and BSD systems, operates a classic double-extortion model, and abuses legitimate drivers plus custom tooling to bypass defenses. SystemBC is a SOCKS5 tunneling proxy that uses RC4-encrypted C2 communications and can download and execute additional malware in memory. Attack chain: initial access via internet-facing services or compromised credentials, followed by reconnaissance, Cobalt Strike deployment, SystemBC tunneling, lateral movement using Group Policy Objects for domain-wide compromise, then the encryptor. A notable TTP: during lateral movement, The Gentlemen pushes a PowerShell script that disables Windows Defender real-time monitoring, adds broad exclusions for staging shares and its own process, shuts down the firewall, re-enables SMB1, and loosens LSA anonymous access controls before deploying the ransomware binary on each reachable host. The ESXi variant shuts down virtual machines, adds persistence via crontab, and inhibits recovery. Victim geography spans US, UK, Germany, Australia, and Romania.

the-gentlemenransomwareraassystembcgpo-abusedefender-evasionesxilateral-movement
Check
Audit your environment for SystemBC indicators and GPO abuse patterns. The Gentlemen's 1,570+ victim count means there's a meaningful chance you or your peers are already compromised without knowing it.
Affected
Any organization with internet-facing services (VPN gateways, RDP, remote admin portals) or weak credential hygiene is at risk of initial access. Environments where Windows Defender exclusions can be modified via GPO, where SMB1 can be re-enabled, or where LSA anonymous access controls can be loosened are at acute risk of the full attack chain. VMware ESXi environments are specifically targeted by a Linux variant.
Fix
Hunt for SystemBC: look for outbound SOCKS5 connections to non-corporate destinations, RC4-encrypted traffic patterns, and unexpected tunneling processes. Alert on any GPO modification that adds Windows Defender exclusions, disables real-time monitoring, re-enables SMB1, or loosens LSA anonymous access settings - these are near-certain indicators of ransomware staging. For ESXi, monitor for unauthorized crontab modifications and VM shutdown commands. Review privileged credentials used in GPO management - compromise of a single GPO admin account gives attackers domain-wide ransomware deployment capability. Confirm backups are offline and immutable; The Gentlemen's ESXi variant actively inhibits recovery.
threat
2026-03-30

New RoadK1ll implant turns compromised hosts into silent network relays via WebSocket tunneling

Blackpoint discovered a new Node.js-based implant called RoadK1ll during an incident response engagement. It's not a traditional RAT - it carries no large command set. Instead, it does one thing well: turn a compromised machine into a controllable relay point that lets attackers pivot to internal systems that would normally be unreachable from outside. It communicates over WebSocket, blends into normal web traffic, supports multiple concurrent connections, and auto-reconnects if disrupted.

roadk1llwebsocketlateral-movementpivotingnodejs
Check
Monitor endpoints for unexpected Node.js processes maintaining persistent outbound WebSocket connections to unfamiliar addresses.
Affected
Any Windows or Linux system where an attacker has achieved initial access. RoadK1ll is a post-compromise tool deployed after initial entry.
Fix
Validate network segmentation controls to ensure compromised hosts cannot freely reach sensitive internal services. Block outbound WebSocket traffic to unknown IPs on non-standard ports. Check for the IOCs published by Blackpoint.