Full Report
The report provides an overview on tactics, techniques, and procedures (TTPs) of The Gentlemen observed by Group-IB in intrusions conducted by its affiliates, as well as relevant information about the group's capabilities collected from underground private sources.
Analysis Summary
# Tool/Technique: The Gentlemen’s TTPs (RMM & Post-Exploitation)
## Overview
This entry summarizes the Tactics, Techniques, and Procedures (TTPs) associated with "The Gentlemen," a threat group/affiliate collective. The group focuses on using legitimate Remote Monitoring and Management (RMM) tools, open-source forensic frameworks, and automated deployment scripts to maintain persistence and facilitate lateral movement within compromised environments.
## Technical Details
- **Type**: Tool / Technique (Abuse of legitimate software)
- **Platform**: Windows
- **Capabilities**: Remote Access, Persistence, Credential Harvesting, Automated Deployment.
- **First Seen**: Observed in recent 2024 intrusions by Group-IB.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1543.003 - Create or Modify System Process: Windows Service]
- [T1133 - External Remote Services]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1070 - Indicator Removal on Host]
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Services: Remote Desktop Protocol]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software]
## Functionality
### Core Capabilities
- **Remote Administration**: Abuse of AnyDesk and MeshCentral for direct GUI access to victim machines.
- **Automated Deployment**: Use of batch scripts (`deploy.cmd`) and PowerShell functions to install RMM tools silently across a network.
- **Credential Manipulation**: Scripts include functionality to set hardcoded passwords for RMM tools and create hidden local administrator accounts.
### Advanced Features
- **Conti-Style Automation**: Adoption of PowerShell functions previously associated with the Conti ransomware group to automate the download and installation of AnyDesk.
- **Defense Evasion (Account Hiding)**: Utilization of registry keys (`SpecialAccounts\Userlist`) to hide newly created malicious administrator accounts from the Windows logon screen.
## Indicators of Compromise
- **File Names**:
- `deploy.cmd`
- `anydesk.exe`
- **Registry Keys**:
- `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\oldadministrator`
- **Network Indicators**:
- `hxxp[:]//download[.]anydesk[.]com/AnyDesk[.]exe` (Legitimate URL abused for staging)
- **Behavioral Indicators**:
- Execution of AnyDesk with `--install`, `--start-with-win`, and `--silent` flags.
- Unexpected use of `net user` and `net localgroup` commands to create "oldadministrator".
- Use of `NetExec` (formerly CrackMapExec) for lateral movement and script execution.
## Associated Threat Actors
- **The Gentlemen** (and their affiliates)
- **Conti** (Source of specific PowerShell deployment techniques)
## Detection Methods
- **Signature-based**: Detect the specific hardcoded passwords mentioned in scripts (e.g., `Passw0rd!`, `J9kzQ2Y0qO`, `qc69t4B#Z0kE3`).
- **Behavioral detection**:
- Monitor for AnyDesk or MeshCentral installations originating from unexpected paths like `\AppData\Local\Temp\` or `\ProgramData\`.
- Alert on registry modifications to the `SpecialAccounts\Userlist`.
- Monitor for `anydesk.exe --get-id` execution, which is used by attackers to retrieve the target's connection ID.
## Mitigation Strategies
- **Software Restriction Policies**: Implement Allow-listing to prevent the execution of unauthorized RMM tools (AnyDesk, MeshCentral, etc.).
- **Privileged Access Management**: Restrict the ability of standard users to create new local accounts or modify the `Administrators` group.
- **Network Segmentation**: Limit outbound connections to known RMM provider domains unless strictly required for business operations.
## Related Tools/Techniques
- **NetExec/CrackMapExec**: Used for lateral movement and remote command execution.
- **Velociraptor**: Forensic tool discussed by the group for potential C2/exploitation use.
- **MeshCentral**: Open-source RMM identified in the group's internal communications.