An attacker linked to The Gentlemen ransomware extracted credentials from disk backups and prepared the images for cloud transfer, according to Cisco Talos’s September 17 investigation. The recovery copy itself became a target. [1]
What the command history revealed
Talos reconstructed the sequence from an attacker server’s .bash_history: access a backup share, read VHDX images, copy ntds.dit, SAM and SYSTEM, extract hashes, then compress and transfer backups with Rclone. This is an inferred operational sequence, not proof that every recorded command succeeded. [1]
Why a backup can contain the keys
The filenames matter more than the presence of a familiar transfer utility. Microsoft documents that Active Directory stores domain password information in NTDS.DIT, while local account hashes reside in the Security Account Manager database. A hash is a password-derived value, not necessarily a readable password; nevertheless, it is sensitive authentication material. [2]
That changes the question an administrator needs to ask. “Can we restore this server?” checks recovery. “Who can read its saved contents?” checks confidentiality. A successful restore test cannot answer the second question. A copy intended to preserve the organization’s working state also deserves protection against someone examining that state.
The distinction is particularly important when deciding the scope of an incident. A stolen document archive and a stolen image containing identity data call for different investigations. Responders need to establish what the affected backup contained before treating the event as file loss alone.
Check access, then plan the recovery
CISA recommends offline, encrypted backups and regular tests of their availability and integrity. Its ransomware guide also calls for reviewing affected accounts, preserving relevant evidence and restoring from trusted copies after the environment is secured. [3]
For this scenario, a useful review starts with the backup repository: which accounts could read or export the images, whether those accounts were exposed, and whether retained access or transfer logs show unexpected activity. A scheduled backup job and an unexplained bulk export should not be assessed solely by the name of the software running them.
If identity material may have left the network, involve the team responsible for domain recovery and credentials before reconnecting restored systems. Rebuilding a machine does not recall a copy already taken elsewhere. For the broader containment-and-restoration distinction, see our Gunra ransomware response coverage.
The practical lesson is to test two boundaries separately: whether a backup remains available when production fails, and whether production access also grants a route to read that backup.
References
- Takahiro Takeda, Jordyn Dunk and Michael Szeliga. Ransomware incidents in Japan: The Gentlemen infrastructure investigation. Cisco Talos, September 17, 2026.
- Microsoft. Passwords technical overview. Microsoft Learn, accessed September 19, 2026.
- CISA and MS-ISAC. #StopRansomware Guide. Accessed September 19, 2026.
