Gentlemen Ransomware Disables Defender and Deletes Backups
The ransomware now systematically neutralizes Windows recovery tools, complicating data restoration after an attack.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust that your organization's security measures are sufficient to prevent data loss from ransomware?
The Gentlemen ransomware operation now actively disables Microsoft Defender and deletes Volume Shadow Copies on compromised Windows systems. These measures prevent victims from using native recovery tools to restore data after an encryption attack.
Why it matters
By neutralizing built-in security and removing backup snapshots, this operation significantly reduces the probability of recovering data without paying the ransom. This shift illustrates a focus on hardening the extortion process against common system-level recovery workflows.
The ransomware achieves persistence by applying configuration changes to the OS that explicitly stop Microsoft Defender's real-time protection and add broad directory exclusions to avoid future scans. It further targets the Volume Shadow Copy Service to destroy local file snapshots.
The players
Gentlemen
A ransomware operation that utilizes advanced system configuration manipulation to disable endpoint protection and destroy backups.
Microsoft Defender
The default antimalware component built into the Windows operating system that provides real-time threat monitoring.
The details
The malware functions by modifying system registry keys and service configurations to systematically dismantle endpoint defenses. By stopping backup-related services, it ensures that Volume Shadow Copies — a Windows utility that creates automated backups of file system states — are destroyed. This leaves no local recovery path for encrypted files, forcing organizations to rely entirely on off-site or immutable backups.
Timeline
October 21, 2026: Details regarding the Gentlemen ransomware operation were published.
The Tech Race
The Gentlemen group joins a growing list of threat actors refining anti-recovery techniques as a standard feature of their payloads. This trend forces a competitive pivot where enterprise security stacks must shift from relying on native system tools to implementing immutable, off-line backup storage.
Organizations must treat native Windows recovery options as potentially compromised during an incident and verify that off-site backups are isolated from the primary network. This threat confirms that relying on locally stored volume snapshots is no longer a viable recovery strategy against active ransomware.
The takeaway
This development marks a shift toward more destructive extortion methods that eliminate native recovery pathways. Security teams should prioritize audit logs for unexpected service configuration changes to detect the presence of the ransomware before encryption occurs.
Further reading
Learn more about evolving threat vectors and defensive strategies in our Cybersecurity section.
Live Poll
Do you trust that your organization's security measures are sufficient to prevent data loss from ransomware?
