Argentina: The Gentlemen hit critical sectors

Kaspersky reported the global expansion of the ransomware group The Gentlemen against companies in manufacturing, IT services and technology, healthcare, financial services, construction and logistics. The group has operated under a RaaS model since mid-2025 and, according to the cited report, uses a Go-based backdoor and a Windows encryption variant. At the same time, available material places confirmed ransomware activity in Argentina, attributed by threat intelligence sources to that actor, with a focus on victims such as Oldelval and on relevant industrial sectors in South America.

What techniques did The Gentlemen use?

A threat hunting case study on The Gentlemen documented an attack chain that begins with initial access through Internet-exposed firewall interfaces. The attackers then performed network reconnaissance with Advanced IP Scanner, used PowerRun.exe for privilege escalation, and the ThrottleBlood.sys driver to evade defenses.

SOC Prime linked that attack chain to the abuse of exposed perimeter devices and recommended hardening services such as VPNs and FortiGate interfaces through strong authentication and rapid patching. The technical analysis points to a pattern that combines exposed remote access, internal movement, and mechanisms designed to make detection harder.

What response measures were recommended?

SecurityArsenal described cross-sector campaigns with multiple victims in a matter of days and recommended quickly isolating affected hosts, disabling compromised accounts with broad credential resets, and blocking exfiltration at the perimeter to file-sharing and cloud storage domains. Taken together, the material shows a sustained expansion, with impact on productive and financial sectors and with TTPs already associated with abuse of VPNs, firewalls, and remote access in regional campaigns.