Gentlemen - Ransom Note Drop (T1486)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Correlates the creation of the RESTORE_FILES.txt or GENTLEMEN_README.txt ransom note in multiple directories across the file system, specifically when more than 5 notes are created within a minute by the same process on a device.