In August 2025, Trend Micro investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities through their systematic compromise of enterprise environments.
By adapting their tools mid-campaign—shifting from generic anti-AV utilities to highly targeted, specific variants—the attackers demonstrate versatility and determination, posing a significant threat to organizations regardless of their security defenses. The campaign’s attack chain exposed several highly sophisticated and concerning tactics. Notably, the threat actor exploited legitimate drivers for defense evasion, abused Group Policy Objects (GPO) to facilitate domain-wide compromise, and deployed custom malicious tools designed to disable security solutions present in the environment.
Read more…
Source: Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Shipping giant Maersk confirms data breach as hackers demand $5 million ransom
November 12, 2026
One of the world’s largest shipping and logistics companies, A.P. Moller–Maersk (often just called Maersk) has confirmed it recently suffered a cyberattack in which it lost sensitive data from one of its earlier acquisitions. The criminals are now trying to pressure the company into paying a ransom, threatening to release all of the stolen information on ...
- Attackers use Autonomous AI to target semiconductor, defense and civil society sectors
November 12, 2026
From August–September 2026, Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek. The attackers supplied a target and a goal, then Cairn planned, executed and recorded results on its ...
- Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
November 12, 2026
Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the ...
- Remus malware claims Gmail access even after you change your password
November 11, 2026
Changing your password should be part of recovering a compromised account. The developers of Remus Stealer are advertising a Gmail-reading feature they claim can survive that step and even session revocation. That is a serious claim. It is not, however, a demonstrated capability in the published investigation. Threat intelligence company Hudson Rock examined Remus’s promotional material ...
- Critical vulnerabilities in N-able N-central prompt hosted shutdown
November 10, 2026
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution ...
- Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session
November 9, 2026
Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and ...