The Gentlemen RaaS Tor C2 Routing - tor.exe or SOCKS Proxy Port Connections

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects network activity and process behavior consistent with the use of the Tor network for command and control (C2), specifically targeting patterns associated with The Gentlemen ransomware-as-a-service (RaaS). The rule identifies direct execution of Tor processes, unauthorized connections to common Tor SOCKS proxy ports, and specific network communication with known malicious infrastructure linked to The Gentlemen Go-based backdoor.