GLPI unauthenticated SQL injection via the inventory endpoint, exploited by an operator associated with The Gentlemen RaaS for initial access

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗