Ransomware Series: Gentlemen Ransomware Persistence via UpdateUser/GupdateS Sche

Ibrahim Saud@tektrix

•updated Sep 25, 2026•1•0•4

Detects persistence mechanisms used by The Gentlemen ransomware, specifically the creation of malicious scheduled tasks (UpdateUser, UpdateSystem, or gentlemen_system) and modification of registry Run keys (GupdateS or GupdateU). The rule also monitors for the presence of the operator password string 'G7Vz9eyG' within command line arguments.