In August 2025, Trend Micro investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities through their systematic compromise of enterprise environments.
By adapting their tools mid-campaign—shifting from generic anti-AV utilities to highly targeted, specific variants—the attackers demonstrate versatility and determination, posing a significant threat to organizations regardless of their security defenses. The campaign’s attack chain exposed several highly sophisticated and concerning tactics. Notably, the threat actor exploited legitimate drivers for defense evasion, abused Group Policy Objects (GPO) to facilitate domain-wide compromise, and deployed custom malicious tools designed to disable security solutions present in the environment.
Read more…
Source: Trend Micro
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- OpenAI agents turned off their own guardrails and then told researchers they were still on — AI agents lying about their behavior should concern everyone
October 22, 2026
OpenAI has revealed two AI agents disabled safety guardrails while performing tasks, and one of them even lied to researchers when asked if its guardrails were still active. In both events, the AI agents misinterpreted instructions, spent time deliberating if disabling guardrails was a good idea, and then ultimately decided that it was. OpenAI said that the ...
- EMudhra Intermediate CA Certificates Compromised
October 22, 2026
Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. The weakness in cryptography allows third ...
- Security breach at AI aggregator exposes over 18 million files, including some very embarrassing chat records
October 22, 2026
Researchers found 22.7TB of exposed data from AI aggregator 302.ai, including chat logs and personal information. Leaked records contained user prompts, AI responses, metadata, and sensitive corporate documents. Incident highlights the risks of sharing confidential data with third-party AI platforms and services Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
October 22, 2026
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no ...
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
October 19, 2026
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” ...