GLPI unauthenticated SQL injection via the inventory endpoint, exploited by an operator associated with The Gentlemen RaaS for initial access

cve · CVE-2025-24799 single-source

Coverage timeline

first 2026-09-21 → last 2026-09-21

Peak priority

high

1 high

Sources cited

1 hosts

Sections touched

active-threats

Co-occurring entities

see Co-occurring entities below

ATT&CK techniques

pinned v19.2 · see below

Hunting pivots

ATT&CK techniques

T1003.002 T1003.003 T1018 T1021.001 T1021.002 T1021.006 T1039 T1069.002 T1087.002 T1190 T1210 T1482 T1557.001 T1567.002 T1572 T1595

Affected products

GLPI

ATT&CK techniques

16 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Reconnaissance TA0043

T1595Active Scanning×1

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Credential Access TA0006

T1003.002OS Credential Dumping: Security Account Manager×1

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1003.003OS Credential Dumping: NTDS×1

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay×1

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Discovery TA0007

T1018Remote System Discovery×1

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1069.002Permission Groups Discovery: Domain Groups×1

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1482Domain Trust Discovery×1

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1021.002Remote Services: SMB/Windows Admin Shares×1

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1021.006Remote Services: Windows Remote Management×1

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Collection TA0009

T1039Data from Network Shared Drive×1

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay×1

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Command and Control TA0011

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Exfiltration TA0010

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage×1

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft · ATT&CK page ↗

Story timeline

2026-09-21The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi
active-threatsCisco Talos maps The Gentlemen's AD attack chain, including credential theft from a mounted backup image rather than the live domain controller

Where this entity is cited

active-threats1

Source distribution

blog.talosintelligence.com1 (100%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

GLPI×1
productproduct:glpi
The Gentlemen×1
actoractor:thegentlemen

External references

NVD · cve.org · CISA KEV

All cited sources (1)

blog.talosintelligence.comprimaryCisco Taloshttps://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/
source profile · cited in 2026-09-21

Entries about GLPI unauthenticated SQL injection via the inventory endpoint, exploited by an operator associated with The Gentlemen RaaS for initial access (1)

2026-09-21 · view entry permalink →

HIGHCVE-2025-24799NATOB2

The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi

Cisco Talos recovered an exposed open directory believed to belong to an operator associated with the ransomware-as-a-service brand The Gentlemen, and reconstructed a six-phase attack chain from the directory's own shell command history (Cisco Talos, 2026-09-17). The operator first built a pivot platform using Chisel, Ligolo-ng and SSH tunnels, then ran nmap and masscan against externally exposed hosts and internal services once inside, then used NetExec to enumerate SMB shares, host information, LDAP and computer information in Active Directory; Talos assesses the operator may also have used RustHound/BloodHound-related tools (a Rust BloodHound collector) to collect domain users, groups, computers, administrative privileges and trust relationships for attack-path analysis. For initial footholds against public-facing applications, the actor ran a PoC and sqlmap against CVE-2025-24799, an unauthenticated SQL injection in GLPI's inventory endpoint (fixed in GLPI 10.0.18), and separately downloaded and ran a cPanel/WHM authentication-bypass PoC. Toward the domain controller, the command history shows attempted exploitation of CVE-2020-1472 (Zerologon) and the MS17-010 vulnerabilities alongside NTLM-relay tooling via Responder. Separately, for lateral movement once inside the network, the operator used NetExec and Impacket to attempt authentication against SMB, LDAP, RDP and WinRM across multiple hosts.

The credential-theft step is the chain's most distinctive detail: rather than dumping credentials from a live, monitored domain controller, the operator mounted a backup share over CIFS, installed libguestfs-tools, qemu-utils and nbd-client to inspect the Windows filesystem inside VHDX backup images, copied out ntds.dit, SAM and SYSTEM, and ran Impacket's secretsdump.py offline against the extracted files (Cisco Talos, 2026-09-17). The VHDX backup files themselves (not just the small credential-dump output) were compressed with zstd, split into 256MiB chunks and uploaded concurrently (up to 16 files at a time) to Wasabi cloud storage via rclone, with the operator visibly reconfiguring transfer settings mid-exfiltration to improve speed and reliability. Command and control ran on the open-source AdaptixC2 post-exploitation framework, and Russian-language script comments plus Cyrillic-keymap mistyping in the operator's own bash history (whoami, ls, ip a, clear, exit typed on a Russian keyboard layout) support Talos's existing assessment that The Gentlemen is Russian-speaking-operator-led.

Triage: legitimate backup-verification and disaster-recovery testing also mount VHDX images and inspect their contents, so the mount event alone is not the signal; the discriminator is the immediate follow-on: secretsdump.py or an equivalent credential-extraction tool run against files copied from that mount, on a host or account that has no operational reason to be doing backup verification.

Talos identified open directory infrastructure believed to have been used by a threat actor associated with The Gentlemen. During our investigation, we observed numerous tools used to support ransomware operations.

In Phase 6, involving information collection and exfiltration, the threat actor mounted a backup share via CIFS at /mnt/Backup and inspected the Windows file system within VHDX backups. The command history records the installation of libguestfs-tools, qemu-utils, and nbd-client, the creation of directories such as /mnt/vhdx, and the copying of ntds.dit, SAM, and SYSTEM. The actor then used Impacket's secretsdump.py to extract credentials and password hashes from the collected ntds.dit and SAM files, saving the results as "ntds.txt" and "SAM.txt".

Cisco Talos 2026-09-17

threat21 Sep 04:40Zsingle-sourceOpen finding ↗

Sources: Cisco Talos