The Gentlemen - AnyDesk Silent Deployment

Georg Lauenstein@gsec

•updated Mar 25, 2026•1•0•71

Detects silent AnyDesk deployment with password setting, used by The Gentlemen for persistent remote access. They use --install combined with --start-with-win --silent and --set-password, deployed via NetExec or Conti-style PowerShell functions with hardcoded credentials.