The Gentlemen RaaS GPO Modification for Ransomware Distribution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.