{"description": "Enterprise techniques used by The Gentlemen Ransomware, ATT&CK software S9051 (v1.0)", "name": "The Gentlemen Ransomware (S9051)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1547", "showSubtechniques": true}, {"techniqueID": "T1547.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has written registry keys within HKLM and HKCU to gain persistence device wide and to have redundancy.   [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has added registry keys to maintain persistence through `reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v GupdateS /t REG_SZ /d \u201c\u201d /f` and `reg add HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v GupdateU /t REG_SZ /d \u201c\u201d /f`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1037", "showSubtechniques": true}, {"techniqueID": "T1037.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized the domain\u2019s NETLOGON share to distribute the malicious payload to all domain-joined systems.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1037.004", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized RC scripts to establish persistence in ESXi service.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059", "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized PowerShell to execute commands.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also leveraged PowerShell cmdlets to disable real-time monitoring and set exclusions.(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized Windows Command Shell to execute commands to facilitate lateral movement and other actions.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.012", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized `esxcli` to execute commands on compromised ESXi systems and VMs.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1543", "showSubtechniques": true}, {"techniqueID": "T1543.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has executed service commands using `sc.exe` to modify configurations and set the service to \u201cstart-auto\u201d to run automatically when the system restarted to include `fdrespub`, `fdPHost`, `SSDPSRV` and `upnphost`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1486", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged ephemeral Curve25519 keys with XChaCha20 stream ciphers to encrypt files.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1074", "showSubtechniques": true}, {"techniqueID": "T1074.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has copied malware executables, such as [PsExec](https://attack.mitre.org/software/S0029).exe, to the local `C:\\Temp` directory.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) had also enabled a hidden SMB share pointed at the `C:\\Temp` folder to allow anonymous access.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also consolidated data in `C:\\ProgramData\\data\\`.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1491", "showSubtechniques": true}, {"techniqueID": "T1491.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has the ability to change the system\u2019s desktop wallpaper using a bitmap image file stored as `%TEMP%\\gentlemen.bmp`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1678", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has the functionality to delay for a specified number of minutes before file encryption.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1686", "showSubtechniques": true}, {"techniqueID": "T1686.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has modified windows firewall rules to allow for discovery actions using `netsh advfirewall firewall set rule group=\u201dNetwork Discovery\u201d new enable=Yes` and using the PowerShell command `-Command Get-NetFirewall Rule -DisplayGroup \u201cNetwork Discovery\u201d | Enable-NetFirewallRule`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also modified firewall rules to allow remote desktop access using the command `netsh firewall set service type remotedesktop mode enable` or `netsh advfirewall firewall set rule group=\"remote desktop\" new enable=Yes`.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also deactivated Windows firewall rules using the command ` netsh advfirewall set allprofiles state off`. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has disabled the Windows Firewall settings using the PowerShell cmdlet `powershell -Command Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False`.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1685", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has disabled Microsoft Defender utilizing PowerShell commands to include the cmdlet `Set-MpPreference -DisableRealtimeMonitoring $true -Force`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also utilized the `TaskKill` command to target specific processes associated with backup software, endpoint detection, and office applications.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1685.005", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has used [Wevtutil](https://attack.mitre.org/software/S0645) to clear event logs within system, application and security using the commands `wevtutil cl System`, `wevtutil cl Application`, and `wevtutil cl Security`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1561", "showSubtechniques": true}, {"techniqueID": "T1561.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized a wipe feature that writes 64 MB chunks of data to a targeted drive to exhaust all free space and overwrites previously deleted file content, reducing recovery capabilities.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1484", "showSubtechniques": true}, {"techniqueID": "T1484.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has the ability to modify Group Policy on victim Domain Controllers through a PowerShell script that enables simultaneous ransomware detonation on every computer in domain.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1482", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has gathered Active Directory domain details utilizing the PowerShell cmdlet `Get-ADDomain`.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1689", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has used the following command to re-enable SMB1: `Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart`.(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1675", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized ESXi administration commands to include `vmkfstools` to modify the compromised system.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1083", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has enumerated files and directories using WMI and PowerShell commands.(Citation: MSTI_GentelmenRansomware_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1222", "showSubtechniques": true}, {"techniqueID": "T1222.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has modified the ownership and access control settings to ensure it has unrestricted write access to target file paths prior to encryption.  [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged the `takeown`, `icacls` and `attrib` commands to modify permissions on files and folders.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1564", "showSubtechniques": true}, {"techniqueID": "T1564.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has created hidden SMB share folder named \u201cshare$\u201d that allowed anonymous access.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1564.012", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has modified anti-virus settings to add its own executable to the exclusion list of the endpoint detection solution using the PowerShell command `Add-MpPreference -ExclusionProcess  -force`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has deleted PowerShell command history for all users by targeting the command history file located in `C:/Users/*/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline/ConsoleHost_History.txt`.(Citation: MSTI_GentelmenRansomware_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has deleted forensic artifacts to include prefetch files, defender diagnostic and support logs using both `del /f /q C:\\Windows\\Prefetch\\*.*` and `del /f /q C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026) \n[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also used a batch script named after itself (`.exe.bat`) to delete [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) and the batch script.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070.007", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has removed RDP Logs by leveraging the command `del /f /q %SystemRoot%\\System32\\LogFiles\\RDP*\\*\\*.*`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1490", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has deleted Volume Shadow Copies through the use of `vssadmin delete shadows /all /quiet` and `wmic shadowcopy delete`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also inhibited system recovery by stopping backup services, disabling endpoint protection agents and remote access tools.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1680", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has discovered and enumerated valid drives through a PowerShell script.(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also scanned for letter drives from A: to Z: using `os.Stat` to determine valid drives.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "showSubtechniques": true}, {"techniqueID": "T1036.004", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has deleted preexisting scheduled tasks and created malicious versions of the same named task to execute automatically at system start to include tasks named `UpdateSystem` and `UpdateUser`.(Citation: MSTI_GentelmenRansomware_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also leveraged naming conventions that mimic legitimate VMware services.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1112", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has modified registry keys to allow more permissive access controls to include LSA anonymous access controls.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1106", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized Windows APIs to facility network share discovery actions.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1135", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has discovered and enumerated network shares using `net use` with corresponding sequential drive letters from A through Z.(Citation: MSTI_GentelmenRansomware_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also enumerated network shares using Windows APIs to include `WnetOpenEnumW`, `WNetEnumResourceW`, and `WNetCloseEnum`.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has obfuscated its code using Go libraries such as `Garble`.(Citation: MSTI_GentelmenRansomware_May2026) ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1027.010", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged Base64-encoded PowerShell scripts.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1690", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has prevented command logging through the use of `/dev/null 2 &1` that silences output and discards any written data.(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1090", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized SOCKS proxy connections for C2.(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1021", "showSubtechniques": true}, {"techniqueID": "T1021.001", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has enabled Remote Desktop Protocol within victim environments.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1021.002", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized SMB to enable lateral movement and file transfers.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged network shares to distribute the ransomware payload to other victim devices throughout the domain.(Citation: TrendAI_TheGentlemen_Sept2025) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1053", "showSubtechniques": true}, {"techniqueID": "T1053.003", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged `crontab` to launch the ransomware after a 60-second delay upon reboot using `echo '@reboot sleep 60 && /bin/.vmware-authd ' | crontab - 2>/dev/null`.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1053.005", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has leveraged scheduled tasks to execute itself as system.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also established persistence through the creation of scheduled tasks to include `schtasks /Create /SC ONSTART /TN UpdateSystem /TR \u201c\u201d /RU SYSTEM` and `schtasks /Create /SC ONSTART /TN UpdateUser /TR \u201c\u201d`. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has deleted pre-existing scheduled tasks using `schtasks /Delete /TN UpdateSystem /F` and `schtasks /Delete /TN UpdateUser /F`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1679", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has excluded the `C:\\` volume from scanning to reduce its likelihood of being detected during the encryption process using the PowerShell cmdlet `Add-MpPreference \u2013 ExclusionPath C:\\ -Force`.(Citation: MSTI_GentelmenRansomware_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also excluded encryption of specified file names, and file extensions, to include those associated with critical system functionality.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1489", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has terminated active processes on the victim device. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has stopped Windows services using `sc config  start=disabled`, `net stop ` and `sc stop `.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also disabled running processes using the `taskkill` command for specified processes.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1569", "showSubtechniques": true}, {"techniqueID": "T1569.002", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has executed service commands using `sc.exe` to modify configurations and allow victim hosts to be visible on the local network.(Citation: MSTI_GentelmenRansomware_May2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1529", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has conducted clean shutdowns of running VMs in ESXI environments using `vim-cmd vmsvc/power.off  > /dev/null 2>&1`. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also forcibly terminated running VM processes using `esxcli vm process kill --type=force --world-id= > /dev/null 2>&1`.(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1047", "comment": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized wmic to execute commands on victim devices.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also leveraged WMI to enumerate volumes and drives.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by The Gentlemen Ransomware", "color": "#66b1ff"}]}