The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

216.73.217.22

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

· Published 20/04/2026 15:00 · Modified 20/04/2026 16:54

Essential information

Published: 20/04/2026 15:00
Modified: 20/04/2026 16:54
Tags: 2026-04-20 anydesk cobalt strike domain compromise esxi-encryption group-policy-deployment lateral movement mimikatz psexec ransomware-as-a-service systembc the gentlemen
Related entities: 27 observables, 1 intrusion sets (apt), 46 techniques (mitre), 6 malware, 4 others

Description

The Gentlemen ransomware-as-a-service program has rapidly expanded since mid-2025, claiming over 320 victims with 240 attacks occurring in early 2026. The service provides multi-platform lockers for Windows, Linux, NAS, BSD, and ESXi, enabling comprehensive coverage of corporate environments. During an incident response engagement, an affiliate deployed SystemBC proxy malware for covert tunneling and payload delivery. Analysis of the SystemBC command-and-control server revealed a botnet of over 1,570 victims, primarily corporate and organizational targets. The intrusion progressed from domain controller compromise through credential validation, remote execution via administrative shares, and deployment of Cobalt Strike payloads. Attackers disabled defenses, established persistence through scheduled tasks and services, and ultimately deployed ransomware via Group Policy. The operation demonstrates sophisticated lateral movement capabilities, defense evasion techniques, and integration of mature post-exploit...