The Gentlemen - Data Staging in ProgramData

Georg Lauenstein@gsec

•updated Mar 30, 2026•2•1•67

Detects significant file creation in 'C:\ProgramData\data\' used by The Gentlemen as a staging area for data consolidation before exfiltration via rclone or WinSCP SFTP connections.