The Gentlemen Ransomware SMB SYSVOL/NETLOGON Executable Staging via GPO

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.