The Gentlemen Go Backdoor Spawning Shell from Non-Standard Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule detects Go-compiled backdoor binaries executing from suspicious, non-standard directories (e.g., ProgramData, AppData, Temp, Public) and initiating cmd.exe or powershell.exe for command execution. This behavior is consistent with the deployment and operational tactics of The Gentlemen RaaS group's custom Go-based malware.