The Gentlemen Ransomware Group: AnMed Health Facebook Hijacking, 6TB Data Theft Claims, and Leaked TTP Playbook

Published: August 21, 2026 | RedSheep Reports

A ransomware-as-a-service group calling itself The Gentlemen hijacked AnMed Health's Facebook page on August 11, 2026, posting ransom demands directly to the hospital system's patients and public followers [1]. The posts claimed 6 terabytes of exfiltrated data, including records related to sexual assault, mental health, abortions, and HIV status [1]. Facebook removed the page shortly after the posts appeared. AnMed, a nonprofit health system based in Anderson, South Carolina, had already been contending with a cyberattack disclosed on July 26 that shuttered approximately 80 facilities and knocked out EHR access, phone systems, prescription fulfillment, and scheduling [1]. As of August 10, ten facilities remained closed to appointments [1]. The hackers provided no evidence to support their data theft claims, and AnMed has not confirmed the scope of any impact to patient information [1].

This incident stands out not for the ransomware deployment itself, but for the social media hijacking tactic. Posting ransom demands on a victim's own trusted public channel bypasses traditional media intermediaries and applies direct psychological pressure on patients. It represents a deliberate escalation of the multi-extortion model.

The Gentlemen: Origin and Scale

The Gentlemen emerged in mid-2025, initially as a private cybercrime cell before transitioning to a formal RaaS model later that year [2]. The group is assessed with moderate-to-high confidence to have been founded by a former Qilin ransomware affiliate who uses the moniker "hastalamuerte" and previously led an affiliate crew called ArmCorp within the Qilin program [1][2]. Trend Micro investigated one of the group's early campaigns in September 2025, describing it as "an emerging and previously undocumented threat group" that demonstrated advanced capabilities through systematic compromise of enterprise environments [2].

Growth has been rapid. According to CheckPoint data cited by The Record, The Gentlemen's ransomware was used to extort 332 victims in the first five months of 2026 [1]. Victim counts vary across trackers due to differing methodologies; The Ransom-ISAC blog tracked approximately 130 victims through its own methodology as of May 2026, ranking The Gentlemen as the number two ransomware group in 2026 [3]. The group has targeted at least 17 countries as of Trend Micro's September 2025 analysis, spanning manufacturing, construction, healthcare, and insurance sectors [2]; more recent reporting from other vendors suggests expansion to significantly more countries.

Leaked Chat Analysis: The Gentlemen's Operational Playbook

In mid-2026, Ransom-ISAC published a detailed analysis of leaked internal communications from The Gentlemen group [3]. These leaked chats provide a rare, direct window into the group's operational tradecraft. The sections below draw from that analysis and are critical for defenders building detection and hunting capabilities.

3.1 Initial Access

The Gentlemen's leaked communications reveal a strong preference for exploiting internet-facing infrastructure. The group targeted known vulnerabilities in VPN appliances, remote access gateways, and web-facing applications [3]. Affiliates discussed purchasing access from initial access brokers (IABs) on criminal forums, but also conducted their own scanning and exploitation [3]. Specific chatter referenced targeting unpatched Fortinet, Citrix, and Ivanti appliances [3]. Valid credentials obtained through infostealers and credential marketplaces were also a primary entry vector [3].

3.2 Execution and Persistence

Once inside, affiliates moved quickly to establish persistence. The chats describe deploying remote monitoring and management (RMM) tools, including AnyDesk and other legitimate remote access software, as persistent backdoors [3]. Scheduled tasks and service installations were standard persistence mechanisms [3]. The group discussed creating new domain accounts and adding them to privileged groups to maintain access even after password resets [3].

3.3 Privilege Escalation

The Gentlemen affiliates routinely targeted domain administrator credentials. The leaked chats show operators discussing the use of tools like Mimikatz for credential dumping, alongside abuse of legitimate utilities for privilege escalation [3]. Trend Micro's technical analysis confirmed the group abused PowerRun.exe, a legitimate tool, for privilege escalation in observed campaigns [2]. The group's playbook emphasized gaining domain admin access as a prerequisite before ransomware deployment [3].

3.4 Defense Evasion

Defense evasion was a core competency and a frequent topic in the leaked chats. The Gentlemen developed and iterated on custom tools specifically designed to disable or kill endpoint security products [3]. Trend Micro documented this in detail: the group deployed a Bring Your Own Vulnerable Driver (BYOVD) attack using a malicious driver named ThrottleBlood.sys in conjunction with a custom tool called All.exe to terminate security processes [2]. When initial evasion tools were detected, the group adapted mid-campaign, deploying an enhanced variant called Allpatch2.exe that was customized to neutralize specific security agent components [2].

The leaked chats also reveal affiliates discussing Group Policy Object (GPO) manipulation to disable Windows Defender and other security controls across entire domains [3]. Registry modifications (T1112) and firewall rule changes (T1562.004) were standard procedure [2][3].

3.5 Discovery and Lateral Movement

The group conducted systematic reconnaissance after initial access. A batch script named 1.bat was used for mass account enumeration across domain infrastructure [2]. Affiliates discussed using network scanning tools, Active Directory enumeration, and domain trust discovery to map target environments [3]. Lateral movement relied heavily on SMB (T1021.002), RDP (T1021.001), and SSH (T1021.004) using compromised privileged accounts [2][3].

3.6 Collection and Exfiltration

The Gentlemen staged data for exfiltration using local data staging (T1074.001) and collected files from network shared drives (T1039) [2]. Exfiltration was conducted using cloud storage services and custom exfiltration scripts (T1567.002) over HTTPS-based channels (T1071.001) to move large volumes of data out of victim environments before encryption [2][3].

3.7 through 3.10: Negotiation, Victim Selection, and Internal Operations (Summary)

The remaining sections of Ransom-ISAC's leak analysis cover negotiation tactics, victim selection criteria, internal group dynamics, and revenue sharing [3]. Key takeaways:

• Victim selection: The group prioritized targets with cyber insurance and revenue above certain thresholds. Healthcare organizations were explicitly discussed as high-value targets due to data sensitivity and regulatory pressure to pay [3].
• Negotiation: Affiliates used aggressive negotiation tactics, including threats to contact patients, regulators, and media. The AnMed Facebook hijacking is consistent with this documented approach [3].
• Revenue split: Standard RaaS affiliate models were in place, with the core group taking a percentage of ransom payments [3].
• Internal discipline: The chats reveal disputes between affiliates and core operators over payment splits, access to tools, and operational security failures [3].

Technical Kill Chain (Observed by Trend Micro)

Trend Micro's September 2025 investigation of a Gentlemen campaign provided additional technical depth on the group's tooling [2]:

1. Initial exploitation of internet-facing assets (T1190)
2. Credential compromise of domain accounts (T1078.002)
3. Enumeration via 1.bat for account discovery (T1087.002), permission group discovery (T1069.002), and domain trust discovery (T1482)
4. Defense evasion through BYOVD (ThrottleBlood.sys + All.exe / Allpatch2.exe) to kill endpoint security (T1562.001)
5. GPO abuse to push ransomware deployment across the domain (T1484.001)
6. Service stopping (T1489) prior to encryption
7. Ransomware deployment (T1486) with ransom note README-GENTLEMEN.txt dropped across encrypted systems

IOC Table

MITRE ATT&CK Mapping

Detection and Hunting

BYOVD Detection: Monitor for loading of unsigned or known-vulnerable kernel drivers. The driver ThrottleBlood.sys is a specific indicator, but defenders should also alert on any driver load events (Sysmon Event ID 6) from non-standard paths, particularly C:\Windows\Temp or user-writable directories.

title: Suspicious Driver Load from Temp Directory
status: experimental
author: RedSheepSec
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - '\\Temp\\'
      - '\\AppData\\'
    ImageLoaded|endswith:
      - '.sys'
  condition: selection
falsepositives:
  - Legitimate software installers that stage drivers in temp directories
level: high

Anti-AV Tool Execution: Hunt for execution of All.exe or Allpatch2.exe in process creation logs. More broadly, look for processes that rapidly terminate multiple security-related services or processes in sequence.

GPO Abuse: Monitor for Group Policy modifications outside of change windows. Event IDs 5136 and 5137 in Active Directory audit logs capture GPO changes. Unauthorized creation or modification of GPOs that push scheduled tasks or disable security features is a high-confidence indicator.

RMM Tool Abuse: Alert on installation or execution of AnyDesk, ScreenConnect, or similar RMM tools that are not part of your authorized software inventory. Correlate with network connections to known RMM vendor infrastructure.

Batch Script Enumeration: The filename 1.bat is generic, but the behavior pattern of rapid, sequential LDAP queries or net group / net user commands across domain controllers from a single workstation is detectable through command-line logging (Sysmon Event ID 1, Windows Event ID 4688 with command-line auditing enabled).

Exfiltration Volume: Monitor for large outbound data transfers, particularly to cloud storage endpoints. A 6TB exfiltration claim, even if unverified in the AnMed case, suggests sustained, high-volume outbound transfers that should trigger DLP or NetFlow-based alerts.

Ransom Note File Creation: Monitor for creation of README-GENTLEMEN.txt across multiple directories in rapid succession, which indicates active encryption.

Analysis

The AnMed attack demonstrates The Gentlemen's full multi-extortion playbook: encrypt, exfiltrate, and then apply maximum psychological pressure through unconventional channels. The Facebook hijacking is a tactical innovation that other groups will likely replicate. It costs the attacker nothing, generates immediate media coverage, and puts the victim in the position of having to publicly deny or confirm claims before their investigation is complete.

The group's trajectory from emergence in mid-2025 to 332 extortion victims in the first five months of 2026 [1] represents an unusually steep growth curve, even by RaaS standards. The leaked chats analyzed by Ransom-ISAC [3] explain part of this: The Gentlemen runs a disciplined affiliate program with clear playbooks, custom tooling that gets iterated when detected, and aggressive victim selection focused on organizations with cyber insurance and regulatory exposure.

Healthcare targeting appears deliberate, not opportunistic. The leaked chats explicitly discuss healthcare as high-value due to regulatory pressure and data sensitivity [3]. The AnMed attack, with its claims of HIV records, mental health records, and sexual assault victim files, is calibrated to maximize shame-based pressure on both the institution and individual patients.

References

[1] https://therecord.media/ransomware-group-hijacks-hospital-facebook-amid-cyberattack-response

[2] https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html

[3] https://ransom-isac.org/blog/the-gentlemen-leak-analysis/

Hunt Guide: The Gentlemen Ransomware Group — Healthcare RaaS Operations

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If The Gentlemen RaaS group or affiliated operators are active in our environment, we expect to observe large-volume outbound data transfers to cloud storage services, LSASS credential access attempts, mass service disruption across clinical systems, lateral movement via PsExec/WMI/PowerShell remoting, and anomalous scheduled task or service creation across multiple endpoints in Sysmon, network flow, proxy, and authentication logs.

Intelligence Summary: On July 26, 2026, AnMed Health disclosed a cybersecurity disruption involving malware that led to the closure of 83 facilities. A RaaS group calling itself The Gentlemen claimed responsibility, alleging exfiltration of 6TB of patient data and hijacking AnMed's Facebook page to post ransom demands directly to patients. AnMed has not confirmed the identity of the attacking group or verified the data theft claims. Multiple threat intelligence sources assess The Gentlemen as one of the most prolific ransomware operations of 2026, with hundreds of claimed victims across healthcare, energy, and government sectors globally.

Confidence: Moderate | Priority: Critical

Scope

• Networks: All clinical network segments including EHR servers, workstations, medical device subnets, VPN concentrators, and DMZ services. Priority on segments hosting patient data (EHR, PACS, lab systems) and internet-facing services (VPN, remote access, web portals).
• Timeframe: 90-day lookback period (recommended: last 90 days from hunt start). RaaS groups typically maintain persistence for weeks before encryption. The AnMed timeline shows approximately 2 weeks between initial compromise disclosure and data leak site posting, but actual dwell time may be significantly longer.
• Priority Systems: EHR servers, Active Directory domain controllers, VPN concentrators, backup infrastructure, clinical workstations with patient data access, administrative jump boxes, and internet-facing appliances (VPN, firewall, remote access gateways).

MITRE ATT&CK Techniques

T1486 — Data Encrypted for Impact (Impact) [P2]

The Gentlemen's ransomware claim and the pattern of near-total operational disruption at AnMed (EHR, phone systems, scheduling, prescription fulfillment) are consistent with widespread file encryption. AnMed disclosed only a 'malware disruption,' and the ransomware characterization comes from The Gentlemen's own claims, not AnMed.

Splunk SPL:

index=sysmon EventCode=11 TargetFilename="*.encrypted" OR TargetFilename="*.locked" OR TargetFilename="*.crypt" OR TargetFilename="*.enc" OR TargetFilename="*.ransom"
| stats count by Computer, TargetFilename, Image
| where count > 50
| sort - count
| table Computer, Image, TargetFilename, count

Elastic KQL:

event.code:"11" AND file.name:(*.encrypted OR *.locked OR *.crypt OR *.enc OR *.ransom)

Sigma Rule:

title: Mass File Encryption Indicative of Ransomware
id: b7e2c3d4-1f56-4a8b-9c0e-3d2f7a6b8c1d
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects creation of files with common ransomware extensions across multiple files in a short timeframe, indicative of ransomware encryption activity.
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.encrypted'
            - '.locked'
            - '.crypt'
            - '.enc'
            - '.ransom'
    condition: selection
    timeframe: 5m
    count: 100
falsepositives:
    - Legitimate encryption tools
    - Backup software creating encrypted archives
level: critical
tags:
    - attack.impact
    - attack.t1486

Ransomware file extensions vary by variant. Tune the extension list based on known Gentlemen payloads if IOCs become available. Also consider hunting for ransom note file creation (e.g., README.txt, DECRYPT.txt) across many directories simultaneously. The threshold of 100 files in 5 minutes should be tuned to environment baselines.*

T1567 — Exfiltration Over Web Service (Exfiltration) [P2]

The claimed 6TB exfiltration volume suggests sustained, high-bandwidth data transfers to external cloud storage or web services over days or weeks prior to encryption. Common exfiltration destinations for RaaS groups include Mega.nz, Dropbox, AWS S3, Azure Blob, and Google Drive. The specific exfiltration method for this incident is unknown.

Splunk SPL:

index=corelight sourcetype=corelight_conn id.resp_p IN (443, 80, 8080)
| eval bytes_out_mb = orig_bytes / 1048576
| where bytes_out_mb > 500
| stats sum(bytes_out_mb) as total_mb_out, count as session_count by id.orig_h, id.resp_h
| where total_mb_out > 1024
| sort - total_mb_out
| table id.orig_h, id.resp_h, total_mb_out, session_count

Elastic KQL:

source.bytes:>524288000 AND NOT destination.ip:(10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

Sigma Rule:

title: Anomalous Large Outbound Data Transfer
id: a3f8c1d2-9e45-4b7a-b6c3-2d1e8f4a5b9c
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects potential data exfiltration via anomalously large outbound transfers to external destinations. Threshold of 1GB should be tuned to your environment baseline.
logsource:
    category: proxy
    product: any
detection:
    selection:
        bytes_out|gte: 1073741824
    filter:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter
falsepositives:
    - Legitimate large file transfers to cloud backup services
    - Software update distribution
level: medium
tags:
    - attack.exfiltration
    - attack.t1567

Tune the byte threshold based on your environment's normal outbound transfer patterns. Healthcare orgs often have large legitimate transfers (imaging data, backups). Correlate with DNS queries to known cloud storage domains. The source report's Sigma rule is preserved here with adjusted context.

T1567 — Exfiltration Over Web Service — DNS-Based Detection (Exfiltration) [P2]

Complementary detection looking for DNS queries to known file-sharing and cloud storage domains from servers and workstations that do not normally generate such traffic, as recommended in the source report.

Splunk SPL:

index=corelight sourcetype=corelight_dns
| where match(query, "(?i)(mega\.nz|mega\.co\.nz|megaupload|dropbox\.com|dl\.dropboxusercontent|amazonaws\.com|blob\.core\.windows\.net|drive\.google\.com|storage\.googleapis\.com|file\.io|transfer\.sh|send\.tresorit|gofile\.io|anonfiles|wetransfer\.com)")
| stats count as query_count, dc(query) as unique_queries, values(query) as queried_domains by id.orig_h
| where query_count > 5
| sort - query_count
| table id.orig_h, query_count, unique_queries, queried_domains

Elastic KQL:

dns.question.name:(*mega.nz OR *mega.co.nz OR *dropbox.com OR *amazonaws.com OR *blob.core.windows.net OR *drive.google.com OR *storage.googleapis.com OR *file.io OR *transfer.sh OR *gofile.io OR *wetransfer.com)

Sigma Rule:

title: DNS Queries to Cloud Storage and File Sharing Services from Non-Standard Hosts
id: c4d9e2f1-3a67-4b8c-9d0e-5f1a2b3c4d5e
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects DNS resolution attempts to known cloud storage and file sharing services that may indicate data staging or exfiltration. Focus on servers and clinical workstations that should not normally access these services.
logsource:
    category: dns
    product: any
detection:
    selection:
        query|contains:
            - 'mega.nz'
            - 'mega.co.nz'
            - 'dropbox.com'
            - 'dl.dropboxusercontent.com'
            - 'file.io'
            - 'transfer.sh'
            - 'gofile.io'
            - 'anonfiles'
            - 'wetransfer.com'
    condition: selection
falsepositives:
    - Legitimate use of cloud storage services by authorized users
    - Marketing or communications teams using file sharing services
level: medium
tags:
    - attack.exfiltration
    - attack.t1567

Whitelist known legitimate cloud storage usage. Focus hunting on servers, EHR workstations, and medical device subnets that should never query these domains. Cross-reference with the large outbound transfer detection for high-confidence alerts.

T1078 — Valid Accounts (Initial Access) [P2]

The Facebook account compromise at AnMed likely involved credential theft (phishing, credential stuffing, or harvesting from compromised endpoints with stored browser sessions). Valid accounts are also a common RaaS initial access method, particularly VPN and RDP credentials purchased from initial access brokers. The exact method is not confirmed.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4624 Logon_Type=10
| eval hour=strftime(_time, "%H")
| stats count as login_count, dc(Workstation_Name) as unique_workstations, values(Workstation_Name) as workstations by Account_Name, Source_Network_Address
| where login_count > 10 OR unique_workstations > 3
| sort - login_count
| table Account_Name, Source_Network_Address, login_count, unique_workstations, workstations

Elastic KQL:

event.code:"4624" AND winlog.event_data.LogonType:"10" AND NOT source.ip:(10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

Sigma Rule:

title: Anomalous RDP Logon from External Source
id: d5e0f3a2-4b78-4c9d-ae1f-6g2b3c4d5e6f
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects Remote Desktop (Type 10) logons from external or unusual source addresses, which may indicate use of compromised credentials by a RaaS affiliate.
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
    filter_internal:
        IpAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.1/32'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate remote administration via RDP through VPN (should be from internal VPN pool IPs)
    - Third-party support sessions
level: high
tags:
    - attack.initial_access
    - attack.t1078

Correlate with VPN logs to identify impossible travel scenarios. Also hunt for service account interactive logons (Logon_Type 2 or 10) which should be extremely rare. For the social media angle, audit organizational social media admin accounts for unauthorized access — this is outside typical SIEM visibility but critical for this threat.

T1078 — Valid Accounts — VPN Impossible Travel (Initial Access) [P2]

RaaS affiliates commonly use VPN credentials purchased from initial access brokers. Detecting impossible travel (logins from geographically distant locations in impossible timeframes) can identify compromised VPN accounts.

Splunk SPL:

index=firewall-pan sourcetype="pan:traffic:aggregated" app="ssl-vpn" OR app="ipsec"
| iplocation src_ip
| stats earliest(_time) as first_seen, latest(_time) as last_seen, dc(src_ip) as unique_ips, dc(Country) as unique_countries, values(src_ip) as source_ips, values(Country) as countries by src_user
| where unique_countries > 1
| eval time_span_hours = round((last_seen - first_seen) / 3600, 2)
| where time_span_hours < 4
| table src_user, unique_ips, unique_countries, countries, source_ips, time_span_hours

Elastic KQL:

event.action:"vpn-login" AND source.geo.country_name:* | stats count by user.name, source.geo.country_name

Tune the time window and geographic distance thresholds. Exclude known travel patterns for remote employees. Cross-reference with HR travel records if available.

T1489 — Service Stop (Impact) [P2]

AnMed confirmed disruption of phone systems, EHR, scheduling, and prescription fulfillment systems. RaaS groups commonly stop services (backup agents, databases, AV) before encryption to maximize impact and prevent recovery.

Splunk SPL:

index=winevent sourcetype=WinEventLog EventCode=7036 "entered the stopped state"
| stats count as stop_count by host, Message
| where stop_count > 5
| sort - stop_count
| table host, Message, stop_count

Elastic KQL:

event.code:"7036" AND message:"entered the stopped state"

Sigma Rule:

title: Mass Service Stop Indicative of Pre-Encryption Activity
id: e6f1a4b3-5c89-4dae-bf2a-7h3c4d5e6f7g
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects multiple Windows services being stopped in a short timeframe, a common precursor to ransomware encryption that targets backup agents, AV, databases, and healthcare application services.
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7036
        param2: 'stopped'
    condition: selection | count() by Computer > 10
falsepositives:
    - System maintenance windows with scheduled service restarts
    - Patch deployment cycles
level: high
tags:
    - attack.impact
    - attack.t1489

Tune the count threshold based on normal maintenance patterns. Whitelist known patching windows. Prioritize alerts that include critical healthcare services (Epic, Cerner, MEDITECH process names). Also monitor for sc.exe stop or net stop commands via Sysmon EventID 1.

T1489 — Service Stop — Command Line Detection (Impact) [P2]

Detection of command-line service stop commands commonly used by ransomware operators to disable backup, AV, and database services before encryption.

Splunk SPL:

index=sysmon EventCode=1 (CommandLine="*net stop*" OR CommandLine="*sc stop*" OR CommandLine="*taskkill*" OR CommandLine="*wmic*process*delete*")
| stats count as cmd_count, dc(Computer) as host_count, values(Computer) as hosts by User, CommandLine
| where cmd_count > 3 OR host_count > 1
| sort - cmd_count
| table User, CommandLine, cmd_count, host_count, hosts

Elastic KQL:

process.command_line:(*"net stop"* OR *"sc stop"* OR *taskkill* OR *"wmic"*"process"*"delete"*) AND event.code:"1"

Look for rapid sequences of service stops targeting security products (MsMpEng, ccSvcHst, VEEAM services, SQL Server services). Cross-reference with the mass file encryption detection for high-confidence ransomware activity.

T1003.001 — OS Credential Dumping: LSASS Memory (Credential Access) [P2]

RaaS affiliates commonly dump credentials from LSASS memory using tools like Mimikatz or direct memory access. This enables lateral movement across the victim network. While not confirmed for this specific incident, credential dumping via LSASS is a standard RaaS affiliate TTP noted in the source report's general guidance.

Splunk SPL:

index=sysmon EventCode=10 TargetImage="*\\lsass.exe" NOT SourceImage IN ("*\\csrss.exe", "*\\MsMpEng.exe", "*\\wininit.exe", "*\\svchost.exe", "*\\services.exe", "*\\lsass.exe", "*\\wmiprvse.exe", "*\\taskmgr.exe", "*\\procexp*.exe")
| eval granted_access_hex = GrantedAccess
| where granted_access_hex="0x1010" OR granted_access_hex="0x1410" OR granted_access_hex="0x1438" OR granted_access_hex="0x143a" OR granted_access_hex="0x1fffff"
| stats count by Computer, SourceImage, TargetImage, GrantedAccess, SourceUser
| sort - count
| table Computer, SourceImage, TargetImage, GrantedAccess, SourceUser, count

Elastic KQL:

event.code:"10" AND winlog.event_data.TargetImage:*lsass.exe AND NOT winlog.event_data.SourceImage:(*csrss.exe OR *MsMpEng.exe OR *wininit.exe OR *svchost.exe OR *services.exe)

Sigma Rule:

title: LSASS Memory Access by Non-Standard Process
id: f7a2b5c4-6d90-4eaf-c03b-8i4d5e6f7a8h
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects access to LSASS process memory from non-standard processes, indicative of credential dumping tools such as Mimikatz. Common RaaS affiliate lateral movement precursor.
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x1438'
            - '0x143a'
            - '0x1fffff'
    filter_legitimate:
        SourceImage|endswith:
            - '\csrss.exe'
            - '\wininit.exe'
            - '\MsMpEng.exe'
            - '\svchost.exe'
            - '\services.exe'
            - '\lsass.exe'
            - '\wmiprvse.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Security products performing process inspection
    - Legitimate admin tools (Process Explorer, Process Monitor)
level: critical
tags:
    - attack.credential_access
    - attack.t1003.001

This is a high-fidelity detection. Tune the SourceImage filter to include your organization's specific EDR and security product binaries. Any LSASS access from unsigned or unknown binaries should be treated as critical.

T1021.002 — Remote Services: SMB/Windows Admin Shares (Lateral Movement) [P2]

RaaS affiliates commonly use PsExec and other admin tools for lateral movement via SMB. The source report specifically notes PsExec, WMIC, and PowerShell remoting as expected lateral movement techniques for mature RaaS operations.

Splunk SPL:

index=sysmon EventCode=1 (Image="*\\PsExec*" OR Image="*\\PSEXESVC*" OR CommandLine="*\\ADMIN$*" OR CommandLine="*\\C$*" OR CommandLine="*\\IPC$*")
| stats count as exec_count, dc(Computer) as host_spread, values(Computer) as target_hosts by User, Image, CommandLine, ParentImage
| where exec_count > 1 OR host_spread > 1
| sort - host_spread
| table User, Image, CommandLine, ParentImage, exec_count, host_spread, target_hosts

Elastic KQL:

(process.name:PsExec* OR process.name:PSEXESVC* OR process.command_line:*ADMIN$* OR process.command_line:*C$* OR process.command_line:*IPC$*) AND event.code:"1"

Sigma Rule:

title: PsExec Service Installation or Remote Execution
id: a8b3c6d5-7e01-4fb0-d14c-9j5e6f7a8b9i
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects PsExec service installation and remote execution patterns commonly used by RaaS affiliates for lateral movement.
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PsExec.exe'
            - '\PsExec64.exe'
            - '\PSEXESVC.exe'
    selection_adminshare:
        CommandLine|contains:
            - '\\ADMIN$'
            - '\\C$'
            - '\\IPC$'
    condition: selection_psexec or selection_adminshare
falsepositives:
    - Legitimate system administration using PsExec
    - SCCM or other management tools using admin shares
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002

PsExec renamed or recompiled will evade filename-based detection. Supplement with Sysmon named pipe detection (EventID 17/18) for pipe names matching PSEXESVC-. Also hunt for WMIC process calls targeting remote hosts.*

T1053.005 — Scheduled Task/Job: Scheduled Task (Persistence) [P2]

RaaS groups commonly use scheduled tasks for persistence and to execute ransomware payloads across multiple systems. The source report notes scheduled task creation as an expected persistence mechanism.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4698
| stats count as task_count, dc(host) as host_count, values(host) as hosts by SubjectUserName, TaskName, TaskContent
| where task_count > 3 OR host_count > 2
| sort - host_count
| table SubjectUserName, TaskName, TaskContent, task_count, host_count, hosts

Elastic KQL:

event.code:"4698" AND NOT winlog.event_data.TaskName:(*Microsoft* OR *Windows*)

Focus on scheduled tasks created outside of change windows, created by non-admin accounts, or targeting multiple systems in rapid succession. Look for tasks executing scripts from TEMP, AppData, or ProgramData directories.

T1059.001 — Command and Scripting Interpreter: PowerShell (Execution) [P2]

PowerShell remoting is explicitly cited in the source report as a common lateral movement and execution mechanism for RaaS affiliate operations. Encoded commands and download cradles are frequently used for payload delivery.

Splunk SPL:

index=powershell sourcetype=XmlWinEventLog EventCode=4104
| where match(ScriptBlockText, "(?i)(invoke-mimikatz|invoke-expression|iex|downloadstring|downloadfile|encodedcommand|bypass|net\.webclient|start-bitstransfer|invoke-webrequest|reflection\.assembly)")
| stats count by Computer, ScriptBlockText, UserID
| sort - count
| table Computer, UserID, ScriptBlockText, count

Elastic KQL:

event.code:"4104" AND powershell.script_block_text:(*Invoke-Mimikatz* OR *Invoke-Expression* OR *DownloadString* OR *EncodedCommand* OR *Net.WebClient* OR *Start-BitsTransfer*)

Sigma Rule:

title: Suspicious PowerShell Script Block Execution
id: b9c4d7e6-8f12-4ac1-e25d-0k6f7a8b9c0j
status: experimental
author: RedSheepSec
date: 2026/08/21
description: Detects suspicious PowerShell script block content commonly associated with RaaS affiliate tooling including credential dumping, download cradles, and encoded command execution.
logsource:
    product: windows
    category: ps_script
detection:
    selection:
        ScriptBlockText|contains:
            - 'Invoke-Mimikatz'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Net.WebClient'
            - 'EncodedCommand'
            - 'Start-BitsTransfer'
            - 'Reflection.Assembly'
            - 'AMSI'
    condition: selection
falsepositives:
    - Legitimate administration scripts using Invoke-Expression
    - Security testing tools
level: high
tags:
    - attack.execution
    - attack.t1059.001

Requires PowerShell ScriptBlock Logging (Event ID 4104) to be enabled. This is critical telemetry for RaaS detection. Also monitor for -EncodedCommand flags in Sysmon EventID 1 process creation events.

T1136.001 — Create Account: Local Account (Persistence) [P2]

Creation of new accounts is cited in the source report as a common persistence mechanism for RaaS operations. Detect creation of local accounts that may serve as backdoor access.

Splunk SPL:

index=winevent sourcetype="XmlWinEventLog:Security" EventCode=4720
| stats count by host, SubjectUserName, TargetUserName, SubjectDomainName
| sort - count
| table host, SubjectUserName, TargetUserName, SubjectDomainName, count

Elastic KQL:

event.code:"4720"

Correlate with other persistence indicators (scheduled tasks, services). New local admin accounts created outside of change management windows are high priority.

Suricata Rules

SID 9000001 — Detects potential large outbound data exfiltration to common cloud storage services (Mega.nz) over HTTPS, indicative of ransomware data staging

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - TLS SNI to mega.nz - Potential Data Exfiltration"; tls.sni; content:"mega.nz"; nocase; flow:established,to_server; threshold:type both, track by_src, count 10, seconds 3600; classtype:policy-violation; sid:9000001; rev:1; metadata:created_at 2026_08_21, updated_at 2026_08_21;)

SID 9000002 — Detects potential large outbound data exfiltration to file.io over HTTPS

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - TLS SNI to file.io - Potential Data Exfiltration"; tls.sni; content:"file.io"; nocase; flow:established,to_server; threshold:type both, track by_src, count 5, seconds 3600; classtype:policy-violation; sid:9000002; rev:1; metadata:created_at 2026_08_21, updated_at 2026_08_21;)

SID 9000003 — Detects potential data exfiltration to transfer.sh over HTTPS

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - TLS SNI to transfer.sh - Potential Data Exfiltration"; tls.sni; content:"transfer.sh"; nocase; flow:established,to_server; threshold:type both, track by_src, count 5, seconds 3600; classtype:policy-violation; sid:9000003; rev:1; metadata:created_at 2026_08_21, updated_at 2026_08_21;)

SID 9000004 — Detects potential data exfiltration to gofile.io over HTTPS

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT - TLS SNI to gofile.io - Potential Data Exfiltration"; tls.sni; content:"gofile.io"; nocase; flow:established,to_server; threshold:type both, track by_src, count 5, seconds 3600; classtype:policy-violation; sid:9000004; rev:1; metadata:created_at 2026_08_21, updated_at 2026_08_21;)

Data Source Requirements

Recommendations

• Deploy all Appendix B detection queries across Splunk instances targeting index=sysmon, index=winevent, index=powershell, index=corelight, and index=firewall-pan. Schedule high-priority queries (LSASS access, mass service stops, PsExec lateral movement) as real-time or 5-minute interval alerts.
• Immediately audit all organizational social media accounts (Facebook Business, X/Twitter, LinkedIn, Instagram) for MFA enforcement using hardware security keys or authenticator apps (not SMS). Remove former employees and unnecessary admin accounts. Review linked third-party apps for excessive permissions. This is a direct lesson from the AnMed Facebook hijacking.
• Establish and monitor outbound data transfer baselines. Deploy the large outbound transfer detection (>1GB threshold, tuned to environment) as a persistent search with 15-minute intervals. Add Suricata rules for TLS SNI monitoring to detect connections to mega.nz, file.io, transfer.sh, and gofile.io from clinical network segments.
• Validate that PowerShell ScriptBlock Logging (Event ID 4104) is enabled across all Windows endpoints via Group Policy. This is critical telemetry for detecting RaaS affiliate tooling and is required for the PowerShell-based detections in this hunt.
• Verify that Sysmon configurations include ProcessAccess (EventID 10) logging for LSASS, which is the primary detection mechanism for credential dumping. Ensure the Sysmon config does not exclude lsass.exe as a target.
• Review VPN and remote access logs for the past 90 days, cross-referencing with CISA's Known Exploited Vulnerabilities (KEV) catalog for any unpatched internet-facing appliances (VPN concentrators, firewalls, remote access gateways). Prioritize patching any appliances with KEV-listed vulnerabilities.
• Conduct a tabletop exercise within 30 days testing EHR downtime procedures including paper-based clinical workflows, as AnMed clinicians were forced to revert to paper. Ensure paper order forms, medication administration records, and patient identification workflows are pre-printed and accessible at each care delivery site.
• Brief executive and communications teams on The Gentlemen's social media hijacking tactic. Pre-position a crisis communications plan that accounts for public-facing account compromise scenarios, not just traditional breach notification.
• Hunt for service account interactive logons (Logon_Type 2 or 10 in Event ID 4624) which should be extremely rare and may indicate compromised service accounts being used for lateral movement.

Sources

• HIPAA Journal: AnMed Closes Almost 80 Facilities While It Grapples with Cyberattack
• Ransom-ISAC Blog: The Gentlemen Leak Analysis
• FortiGuard: The Gentlemen Ransomware Threat Actor Profile
• RansomNews: The Gentlemen Ransomware 2026