Gentlemen Ransomware Disables Defender, Destroys Backups to Block Recovery

The Gentlemen ransomware group is deploying sophisticated techniques to disable Windows Defender, destroy backup infrastructure and erase forensic logs, according to a new analysis by Acronis researchers. This operational shift aims to severely limit an organization’s ability to recover systems or investigate the breach after encryption occurs.

Acronis’ Threat Research Unit identified these behaviors in a technical report detailing the group’s malware capabilities. The analysis reveals that the Windows-based malware actively turns off Microsoft Defender’s real-time protection and adds its own processes to exclusion lists. These actions reduce scanning interference while the malware prepares to encrypt victim files.

Technical Tactics and Defense Evasion

The malware’s impact extends beyond simple file encryption. It stops selected processes and services linked to security tools, databases, virtual machines, email systems and backup products. Disrupting these services frees locked files for encryption and prevents routine recovery jobs from running successfully.

Before encrypting data, the malware attempts to remove available Volume Shadow Copies, which Windows uses to restore earlier file versions. It also clears selected Windows logs, prefetch data and PowerShell command history. This log wiping reduces the local evidence available to security responders attempting to understand the attack timeline.

Group Background and Victim Claims

Acronis describes The Gentlemen as a Go-based ransomware-as-a-service operation that emerged in 2025. The group targets Windows, Linux, network-attached storage and BSD systems, employing a double-extortion model. Attackers steal data in addition to encrypting it, raising the risk of public exposure even if victims possess backups.

Acronis states the group has claimed more than 800 victims, though this figure reflects the group’s own assertions rather than independently confirmed infections. As Threat Times reported on October 21, 2026, the group previously exploited kernel drivers from Lenovo and Safetica to bypass endpoint protections. This earlier tactic aligns with their current focus on disabling security tools before encryption.

What should you do?

Security teams should monitor for unauthorized changes to Microsoft Defender settings and exclusion lists. Investigate any sudden stops in backup services or database processes, as these may indicate active ransomware preparation. Review Windows logs for signs of deletion or clearing, which could signal an ongoing intrusion.

What to do and how to stay safe: The Gentlemen

• Monitor endpoint protection logs for unauthorized disabling of real-time monitoring or addition of suspicious exclusions.
• Verify the integrity and status of backup services regularly to ensure they are running and not terminated by malware.
• Check for the presence of Volume Shadow Copies and ensure they are protected from deletion by unauthorized processes.
• Review PowerShell command history and prefetch data for indicators of log wiping or suspicious administrative commands.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific defenses does Gentlemen ransomware disable?

The malware disables Microsoft Defender real-time protection, adds broad exclusions, stops backup and security services, and deletes Volume Shadow Copies.

How many victims has The Gentlemen group claimed?

Acronis reports the group has claimed more than 800 victims, though these figures are not independently confirmed.

What systems does the Gentlemen ransomware target?

The operation targets Windows, Linux, network-attached storage and BSD systems using a Go-based malware platform.