Emerging The Gentlemen Ransomware Abuses Windows Task Scheduler to Escalate Privileges and Spread Laterally

The Gentlemen is an emerging ransomware threat targeting financial, healthcare and educational institutions worldwide. It steals sensitive data before encrypting systems, using a double-extortion model that combines the threat of a data leak with ransom demands. By abusing the built-in Windows Task Scheduler to obtain system-level privileges, it reduces the likelihood of its activity being detected and poses a greater threat.

Microsoft's security team recently disclosed that The Gentlemen can create scheduled tasks to escalate privileges. Its self-propagation and lateral-movement capabilities allow it to rapidly infect devices on the same network, potentially spreading across an entire enterprise environment. At the time of publication, Microsoft had not disclosed the exact date of its findings, the number of affected organizations, total losses or the scale of ransom demands.