Threat Hunting Case Study: Scattered Spider
Scattered Spider skips malware and breaks in with a phone call and a legitimate remote access tool, here's how to hunt for it.
A ransomware group that spent its first few months in an unusually consistent rhythm: break in through an exposed firewall, spend hours mapping the network, kill security tools with a signed driver, then push the payload to every machine on the domain in one shot through the NETLOGON share. That is the pattern behind The Gentlemen, a group that emerged in August 2025 and has consistently ranked among the highest impact data extortion groups.
The Gentlemen first appeared publicly in August 2025, deploying a ransomware variant that carries the group's own name. The group has focused heavily on the Asia-Pacific region, particularly Thailand and North America, but has publicly claimed to have breached over 600 organizations in at least 80 countries.
Targeted industries include manufacturing, insurance, construction and consumer services, but the group has also gone after critical services such as healthcare networks and hospitals and is regularly among the top ransomware threats to the financial services sector.
Since emerging, The Gentlemen has become known as a technically sophisticated threat actor capable of conducting large-scale enterprise intrusions. Recent reported activity indicates the operators increased focus on weakening defensive tooling and establishing broad network visibility before encryption is executed, allowing them to maximize the impact of attacks and increase leverage during negotiations. The group’s activity enables malicious actors to compromise domain infrastructure, steal sensitive organizational data, disable endpoint protections, and encrypt large portions of enterprise environments.
The Gentlemen typically gain initial access through compromised credentials or internet-exposed services, including VPN and firewall appliances such as FortiGate administrative interfaces.
Once inside, the group does not immediately detonate ransomware. They take time to map the internal network using a commodity tool, Advanced IP Scanner, to identify additional machines and locate administrative accounts. To move from a standard foothold to elevated privileges, they run a legitimate system utility called PowerRun.exe.
With administrator access in hand, The Gentlemen move to disable security tooling with its so-called “AV Killer” tool for defense evasion. They load a legitimate, signed Windows driver named ThrottleBlood.sys. With a valid signature, the driver is generally allowed to run by security controls that trust signed code, a classic bring-your-own-vulnerable-driver (BYOVD) technique. The attackers then pair the driver with a separate tool called All.exe to exploit it and force-terminate antivirus and endpoint protection processes.
With defenses down, the group turns to making recovery difficult. They systematically shut down backup and database services, including Veeam, SAP, Oracle and MySQL. At the same time, they stage and exfiltrate data using WinSCP over encrypted channels, and they maintain remote access to compromised systems using AnyDesk, the same remote monitoring and management tool we covered in our threat hunting case study on RMM software abuse and in our recent Scattered Spider case study.
For deployment, The Gentlemen abuse a piece of Windows infrastructure that every domain-joined machine already trusts: the NETLOGON share, an application of Lateral Tool Transfer (T1570). Because every computer in the domain automatically connects to NETLOGON, dropping the ransomware payload there lets it spread to the entire environment at once. Once executed, files are encrypted and appended with the extension .7mtzhh, and a ransom note titled README-GENTLEMEN.txt is left behind.
Also worth noting is the group's broader abuse of legitimate Windows administrative shares such as SYSVOL to distribute payloads across domain-joined machines. This RaaS-and-affiliate structure echoes what we saw in our DragonForce case study, where a similar dual-extortion model was in play.
Everything specific in this attack chain, the driver name, the payload names, the file extension, the ransom note filename, is a static indicator of compromise (IoC). Those indicators are useful for a quick check across your environment, but they decay fast. The Gentlemen, or any affiliate using similar tooling, can rename All.exe, swap out ThrottleBlood.sys for a different vulnerable signed driver, or change the ransomware's file extension on the next build. None of that requires any real effort on the attacker's part, and it renders a static IoC list stale almost immediately.
The Retroactive Threat Detection (RTD) capability on our Verity471 cyber intelligence platform takes the heavy lifting out of checking historical logs for IoCs that may no longer be present in new telemetry. RTD takes newly surfaced IoCs, such as the ones tied to The Gentlemen, static values like ThrottleBlood.sys, the .7mtzhh extension or the README-GENTLEMEN.txt ransom note name, and runs them back against an organization's historical telemetry. This surfaces matches that would otherwise have gone unnoticed because the indicator did not exist yet at the time the activity occurred, giving defenders a way to check whether they were already touched by a known indicator before it was public knowledge.
RTD, however, is designed to answer the question of the past. It cannot tell you what the next variant of The Gentlemen will look like once the file names and extensions change again. That is where a behavioral hunt package in the HUNTER library on the Verity471 platform earns its keep. Instead of chasing a specific file name, we can hunt for the behavior the group relies on regardless of which tools or payload names they are using in a given campaign: creating or elevating an account into a privileged Windows security group to lock down control of the domain, an example of Account Manipulation (T1098).
Placing an account into a privileged group like Domain Admins is what gives The Gentlemen the domain-wide write access to NETLOGON in the first place, so catching this step is a chance to stop them before the payload ever spreads. The hunt package used in this episode is User Added to Default Privileged Windows Security Groups, part of the HUNTER library on the Verity471 platform. This hunt package is designed to capture the activity surrounding the execution of command line arguments that add a user to default privileged Windows security groups, at both the local and domain level.
The query logic looks for the net
command being used with the /add
argument, targeting either group
or localgroup
, where the specified group is one of the standard high-privilege groups: Administrators, Domain Admins, DnsAdmins, Enterprise Admins, Hyper-V Administrators or Schema Admins. Combined, this logic casts a broad net for anyone using net add
to place an account into any domain or local privileged group, which is precisely the move The Gentlemen make once they want to guarantee they cannot be locked out.
Translated into Splunk, the User Added to Default Privileged Windows Security Groups query looks like this:
The query searches for command lines that contain net
and /add
, combined with either group
or localgroup
, and then checks that the command line also references one of the privileged group names such as Administrators or Domain Admins. The results are aggregated by hostname and include the process, process ID, parent process, parent process ID, username and full command line, along with first seen and last seen timestamps.
Running this hunt turns up a hostname where the command line matches all of the criteria: a net
command adding an account to Domain Admins. From there, the results also surface the process chain, the parent process and process ID, giving a starting point to work backward and confirm what spawned the activity in the first place.
Because the query is intentionally broad, some of what it returns will be legitimate IT administration rather than an attacker's work. The next step is to filter that noise out. Start by checking whether the account that was added actually logged in afterward, since a privileged account that was created but never used is a very different signal than one that immediately started authenticating and taking action. If the account did log in, track what it did next. That pattern, an account added to a privileged group and then actively used, is a strong indicator of compromise. It is also worth cross-referencing the account name against change tickets or known administrative activity. Legitimate privileged account changes are usually documented somewhere; if there is no record of it, that raises the priority of the finding.
The Gentlemen do not rely on custom malware to get the job done. Every tool in their chain, from Advanced IP Scanner to PowerRun.exe to net add
, is either commercially available or already built into Windows. That is precisely why a behavioral hunt for privileged group membership changes holds up better over time than a list of file names and extensions that will look different on the group's next campaign.
A video demonstrating this hunt technique can be found here. Register for a free HUNTER community account to access the User Added to Default Privileged Windows Security Groups hunt package and the rest of the free threat hunt content in the HUNTER library on the Verity471 platform, along with visibility into the subscription-only library of advanced hunt packages, detailed analyst notes and proactive recommendations drawn from Intel 471's Malware and Adversary Intelligence.
Scattered Spider skips malware and breaks in with a phone call and a legitimate remote access tool, here's how to hunt for it.
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.
Initial access brokers sell information about or access to compromised computers. Here's how to threat hunt for a known attack behavior involving PowerShell that's used by a prolific initial access broker.