In August 2025, Trend Micro investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities through their systematic compromise of enterprise environments.
By adapting their tools mid-campaign—shifting from generic anti-AV utilities to highly targeted, specific variants—the attackers demonstrate versatility and determination, posing a significant threat to organizations regardless of their security defenses. The campaign’s attack chain exposed several highly sophisticated and concerning tactics. Notably, the threat actor exploited legitimate drivers for defense evasion, abused Group Policy Objects (GPO) to facilitate domain-wide compromise, and deployed custom malicious tools designed to disable security solutions present in the environment.
Read more…
Source: Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- US government warns Linux CVE-2024-1086 flaw is now being exploited for ransomware attacks
November 3, 2025
The US government is warning that a Linux flaw introduced more than a decade ago – and fixed more than a year ago – is being actively used in ransomware attacks. In February 2014, a vulnerability was introduced into the Linux kernel via a commit. The bug was first disclosed in late January 2024, and described ...
- Chicago firm that resolves ransomware attacks had rogue workers carrying out their own hacks
November 2, 2025
Rogue employees of a Chicago company that specializes in negotiating ransoms to mitigate cyber attacks were carrying out their own piracy in a plot to extort millions of dollars from a series of companies, prosecutors say. Kevin Tyler Martin, a ransomware threat negotiator for River North-based DigitalMint at the time of the alleged conspiracy, was among ...
- Update Chrome now: 20 security fixes just landed
October 31, 2025
Google has released an update for its Chrome browser that includes 20 security fixes, several of which are classed as high severity. Most of these flaws were found in Chrome’s V8 engine—the part of Chrome (and other Chromium-based browsers) that runs JavaScript. Chrome is by far the world’s most popular browser, used by an estimated 3.4 ...
- Canadian government claims hacktivists are attacking water and energy facilities
October 31, 2025
The Canadian government has issued a new security alert warning of so-called hacktivists targeting Industrial Control Systems (ICS). The report says the Cyber Centre and the Royal Canadian Mounted Police has received “multiple reports” of incidents involving internet-accessible ICS. Among the reports were an attack on a water facility, in which the miscreants tampered with water ...
- Government hackers breached telecom giant Ribbon for months before getting caught
October 31, 2025
U.S. telecommunications giant Ribbon has confirmed that government-backed hackers had access to its network for almost a year before getting caught, according to a public filing. The telco giant said in a 10-Q disclosure last week with the U.S. Securities and Exchange Commission that a suspected “nation-state actor had gained access to the company’s IT network” ...
- UK: Woman charged after around 100 patient records accessed in data breach
October 31, 2025
A woman has been charged after around 100 patients had their medical records accessed in a data breach at NHS Lothian. The health board has written letters to patients affected by the breach, which they say was caused by one individual at Edinburgh Royal Infirmary. A letter dated last month, seen by STV News, says the ...