The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi

Cisco Talos recovered an exposed open directory believed to belong to an operator associated with the ransomware-as-a-service brand The Gentlemen, and reconstructed a six-phase attack chain from the directory's own shell command history (Cisco Talos, 2026-09-17). The operator first built a pivot platform using Chisel, Ligolo-ng and SSH tunnels, then ran nmap and masscan against externally exposed hosts and internal services once inside, then used NetExec to enumerate SMB shares, host information, LDAP and computer information in Active Directory; Talos assesses the operator may also have used RustHound/BloodHound-related tools (a Rust BloodHound collector) to collect domain users, groups, computers, administrative privileges and trust relationships for attack-path analysis. For initial footholds against public-facing applications, the actor ran a PoC and sqlmap against CVE-2025-24799, an unauthenticated SQL injection in GLPI's inventory endpoint (fixed in GLPI 10.0.18), and separately downloaded and ran a cPanel/WHM authentication-bypass PoC. Toward the domain controller, the command history shows attempted exploitation of CVE-2020-1472 (Zerologon) and the MS17-010 vulnerabilities alongside NTLM-relay tooling via Responder. Separately, for lateral movement once inside the network, the operator used NetExec and Impacket to attempt authentication against SMB, LDAP, RDP and WinRM across multiple hosts.

The credential-theft step is the chain's most distinctive detail: rather than dumping credentials from a live, monitored domain controller, the operator mounted a backup share over CIFS, installed libguestfs-tools, qemu-utils and nbd-client to inspect the Windows filesystem inside VHDX backup images, copied out ntds.dit, SAM and SYSTEM, and ran Impacket's secretsdump.py offline against the extracted files (Cisco Talos, 2026-09-17). The VHDX backup files themselves (not just the small credential-dump output) were compressed with zstd, split into 256MiB chunks and uploaded concurrently (up to 16 files at a time) to Wasabi cloud storage via rclone, with the operator visibly reconfiguring transfer settings mid-exfiltration to improve speed and reliability. Command and control ran on the open-source AdaptixC2 post-exploitation framework, and Russian-language script comments plus Cyrillic-keymap mistyping in the operator's own bash history (whoami, ls, ip a, clear, exit typed on a Russian keyboard layout) support Talos's existing assessment that The Gentlemen is Russian-speaking-operator-led.

Triage: legitimate backup-verification and disaster-recovery testing also mount VHDX images and inspect their contents, so the mount event alone is not the signal; the discriminator is the immediate follow-on: secretsdump.py or an equivalent credential-extraction tool run against files copied from that mount, on a host or account that has no operational reason to be doing backup verification.