The Gentlemen Ransomware: 332 Victims in 5 Months and Your FortiGate Is the Target
The Gentlemen ransomware has claimed 332 confirmed victims across manufacturing, healthcare, and financial services in the first five months of 2026, establishing itself as the second most active ransomware-as-a-service operation globally. A May 4, 2026 internal data leak exposed the group's full playbook, including affiliate identities, victim lists, toolsets, and live ransom negotiation transcripts, confirming that active campaigns are running across more than 20 industries right now.
The Gentlemen is a ransomware-as-a-service (RaaS) platform, operating as a criminal franchise: the core developer builds and maintains the locker malware, admin panel, and infrastructure, while affiliates conduct the actual intrusions and split ransom proceeds. Launched in September 2025 by a Russian-speaking administrator known as zeta88 (also identified as hastalamuerte), the group recruits affiliates with a 90% payout split — 10 percentage points above the industry standard of 80% — and provides hands-on technical support during attacks. Check Point Research's analysis of the leaked 16.22 GB database identified 9 named operators and over 1,570 victims on just one affiliate's command-and-control server.
What makes The Gentlemen ransomware active campaign particularly dangerous is that the group does not rely on phishing for initial access. Affiliates target internet-facing Fortinet FortiGate and Cisco edge appliances, exploiting known CVEs or brute-forcing VPN panels to achieve authenticated access. They spend days enumerating Active Directory, disabling endpoint detection tools, and exfiltrating data before deploying encryption. If your organization runs unpatched FortiGate VPN, exposes NTLM authentication on edge systems, or uses Veeam backup with default configurations, you are an active target of this campaign today.
How Does The Gentlemen Ransomware Attack Work?
The Gentlemen ransomware attack follows a consistent, multi-stage intrusion chain that begins at the network perimeter and ends with domain-wide encryption deployed via Group Policy.
Initial access centers on internet-facing Fortinet FortiGate VPN appliances and Cisco edge devices. Operator qbit, one of the group's nine named affiliates, maintains a live HTML dashboard tracking thousands of internet-facing FortiGate panels, showing reachability, device names, and direct login links in real time. The group exploits CVE-2024-55591 (FortiOS management interface authentication bypass), CVE-2025-32433 (Erlang SSH), and CVE-2025-33073 (NTLM relay) to obtain authenticated access. Where unpatched CVEs are unavailable, affiliates brute-force VPN and web panels using credentials harvested from public breach databases via a custom tool called buildx641, which parses OWA and Microsoft 365 login logs at scale.
Post-exploitation begins with Active Directory enumeration using NetExec and MANSPIDER. The group then performs NTLM relay attacks using RelayKing-Depth and ntlmrelayx, escalating privileges through token impersonation, MSI service abuse, and ADCS misconfigurations spanning ESC1 through ESC17. EDR products are disabled through purpose-built evasion kits including EDRStartupHinder, gfreeze, and glinker, which patch Windows Event Tracing (ETW) logging and registry entries that control security tool startup.
Persistence is established via Cloudflare Zero Trust tunnels, which the operators internally call "cloud gripping," providing long-term covert access that survives reboots and firewall rule changes. The group specifically targets backup infrastructure, including Veeam servers, NAS devices, and iDRAC management controllers, using the "quant" operator's dedicated brute-force hardware to crack credentials at scale.
Encryption deploys as the final step via Group Policy, pushing the Go-based locker to Windows and Linux endpoints simultaneously. ESXi environments receive specialized tooling for hypervisor-level encryption. Victims find ransom notes named README-GENTLEMEN.txt and a desktop wallpaper named gentlemen.bmp.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
Which Sectors Face Active Targeting by The Gentlemen Ransomware?
Manufacturing, technology, healthcare, and financial services face the highest concentration of confirmed attacks. Check Point Research's analysis of one affiliate's C2 infrastructure revealed an active botnet of 1,570 victims, with the infection profile showing deliberate corporate and organizational targeting rather than opportunistic scanning.
Geography skews global: only 13% of The Gentlemen's victims are US-based. The United Kingdom, Brazil, Germany, India, and Thailand each account for significant victim concentrations, meaning this is not a US-centric campaign. Any mid-market or enterprise organization in these geographies with internet-facing edge appliances is a valid target regardless of sector.
The CYFIRMA May 15, 2026 Weekly Intelligence Report documents confirmed The Gentlemen activity against consumer goods, professional services, real estate, and manufacturing organizations, alongside the group's confirmed healthcare targeting. The May 2026 attack on Marutake Co., Ltd., a pharmaceutical and healthcare company in Japan, exemplifies the group's reach into regulated industries.
The group's practice of weaponizing data from prior breaches to compromise related organizations amplifies the true scope of each intrusion. In one documented chain attack reported by Check Point Research, data stolen from a UK software consultancy was reused to compromise a Turkish client company via the same Fortinet VPN credentials. Victims face triple pressure: encrypted systems, threatened publication of stolen data, and the risk of being publicly framed as an access broker responsible for downstream breaches at their own clients.
For context on how stolen credentials fuel these attack chains, the Decryption Digest analysis of credential exposure on the dark web documented 16 billion records available for exactly this type of targeting operation.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
The Gentlemen RaaS: Operator Structure and the Affiliate Network
The Gentlemen ransomware operates as a tightly managed criminal franchise with nine named core operators and an affiliate program offering substantially above-market compensation.
The administrator, zeta88 (also identified as hastalamuerte), previously operated within the Qilin ransomware program before launching The Gentlemen in September 2025. He builds the custom locker, manages the RaaS admin panel, handles infrastructure, and personally participates in encryption events alongside affiliates. He built the entire GLOCKER administration panel in three days using AI coding assistants, preferring DeepSeek and Qwen for development tasks and testing uncensored Qwen 3.5 for operational support.
The affiliate payout model offers a 90/10 split: affiliates retain 90% of each ransom payment and remit 10% to the administrator. The standard across competing RaaS programs sits at 80/20, making The Gentlemen 10 points more attractive to skilled operators seeking a high-value criminal platform. Documented ransom negotiations from the leaked database show initial demands of $250,000 with confirmed settlements at $190,000 per victim.
The operational team includes specialists for each intrusion phase. Operator qbit handles VPN scanning and FortiGate enumeration. Operator quant runs credential harvesting and brute-force infrastructure on dedicated high-performance hardware. Operators named Protagor, Wick, mAst3r, Bl0ck, JeLLy, Kunder, and Mamba conduct intrusions across the affiliate network. The administrator coordinates cryptocurrency laundering through Bitcoin exchange chains, Tinkoff bank QR conversions, and peer-to-peer cash delivery to avoid financial tracking.
The Cisco edge device exploitation techniques used by The Gentlemen closely parallel the nation-state-grade Cisco edge device exploitation documented in CVE-2026-20182, confirming that criminal groups now operate at nation-state intrusion quality through structured franchise models.
“zeta88 runs the infrastructure, builds the locker and RaaS panel, manages payouts, and effectively acts as the administrator — directly participating in encryption events across affiliates.”
Check Point Research — Thus Spoke...The Gentlemen, May 2026
Indicators of Compromise: The Gentlemen Ransomware Active Campaign
The May 4, 2026 database leak provides verified indicators across multiple layers. Security teams should ingest all of the following into SIEM, EDR, and perimeter security platforms as a priority action.
Ransomware file artifacts to hunt across all endpoints and file shares:
- README-GENTLEMEN.txt — ransom note filename on all Windows and Linux platforms
- gentlemen.bmp — desktop wallpaper artifact deployed post-encryption
Confirmed SHA-256 hashes (30 Windows samples and 3 Linux samples published by Check Point Research):
- 025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a (Windows)
- 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f (Windows)
- 1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c (Linux)
Behavioral indicators for pre-encryption detection:
- ETW event logging disabled system-wide, characteristic of EDRStartupHinder and gfreeze tooling
- Outbound Cloudflare WARP tunnel connections originating from non-IT endpoints
- Bulk NTLM relay scanning activity from internal hosts using RelayKing tooling signatures
- Group Policy Object creation or modification with an unknown executable as a startup script
YARA detection strings for the locker binary: "Silent mode", "Encrypt only mapped...shares", "README-GENTLEMEN.txt", "gentlemen.bmp", "[+] Encryption started" — any PE file matching four or more of these strings is a confirmed locker sample.
CVEs to confirm patched across all edge infrastructure: CVE-2024-55591 (FortiOS management interface), CVE-2025-32433 (Erlang SSH), CVE-2025-33073 (NTLM relay).
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
What the May 2026 Internal Leak Revealed About the Operation
On May 4, 2026, the administrator of The Gentlemen acknowledged on underground forums that an internal backend database named "Rocket" had been exfiltrated. The full leak is estimated at 16.22 GB. An account named n7778 made a 44.4 MB partial dataset publicly available and listed the complete archive for sale at 10,000 USD in Bitcoin the following day.
Check Point Research's analysis of the leaked data provided the security community with an unprecedented view into a live RaaS operation. The leak confirmed nine named operators with distinct roles and TOX communication identifiers. It revealed the administrator's direct participation in encryption events, not just platform management. It exposed a botnet of 1,570 victims connected to a single affiliate's C2 server. Detailed negotiation transcripts document initial demands, counteroffers, and final settlement amounts. Bitcoin laundering chains are fully mapped, including exchange buy-desk flows, Tinkoff bank QR conversions, and physical cash delivery routes.
The leak also exposed the group's active vulnerability monitoring process: a live HTML dashboard tracking thousands of internet-facing FortiGate panels, displaying reachability status, device names, and direct login links updated in real time. This is not a passive threat operation scanning the internet opportunistically. The Gentlemen maintains a curated database of potential targets organized for rapid affiliate consumption.
The irony is operational: the group that built its operation on stealing and weaponizing victims' data suffered the same attack. Internal intelligence is now available to defenders, law enforcement, and competing criminal organizations simultaneously. For security teams, the leak delivers high-fidelity IOCs, TTPs, and operator attribution that would normally require years of DFIR engagement to assemble. The damage to organizations already in the group's active pipeline, however, is unchanged by the leak's existence.
Immediate Defensive Steps Against The Gentlemen Ransomware
Organizations with Fortinet or Cisco edge appliances that have not been patched within the last 30 days are at highest risk and should treat the following steps as a P0 response today.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, remediation steps, and every daily briefing.
Why The Gentlemen Ransomware Matters for Your Organization Right Now
The Gentlemen ransomware active campaign represents a structural shift in the threat landscape: criminal groups achieving nation-state intrusion quality at franchise scale. The leaked database confirms this is not a sporadic wave of opportunistic attacks. It is a structured, managed program with dedicated specialists for each intrusion phase, active CVE monitoring, purpose-built EDR evasion tools, and a financial operation complex enough to require layered money laundering across cryptocurrency exchanges, banking systems, and physical cash networks.
Three facts define the immediate risk level. First, 332 published victims in five months means the group is compromising on average more than two organizations every single day. Second, the 1,570 victims on one affiliate's C2 server includes organizations that have not yet received a ransom demand, meaning breach has occurred but monetization is still pending. Third, the May 4 leak has now exposed the group's full toolchain to every security team and law enforcement agency globally, almost certainly accelerating a rebranding or infrastructure pivot in the coming weeks.
The window to act on the intelligence advantage from this leak is narrow. The Gentlemen ransomware operators will rebrand or restructure once the leak's operational damage becomes clear. Organizations running unpatched Fortinet or Cisco edge appliances, exposed NTLM authentication, or internet-reachable backup infrastructure must treat today as their last no-cost opportunity to close these gaps before the group resurfaces under a new name with a refreshed toolchain.
Patch FortiGate for CVE-2024-55591. Disable NTLMv1. Isolate backup systems. The Gentlemen ransomware is not a future threat. Their operators are running active campaigns across manufacturing, healthcare, and financial services today, and your FortiGate login panel may already be visible on their tracking dashboard.
The bottom line
The Gentlemen ransomware active campaign has reached 332 confirmed victims in five months by exploiting unpatched FortiGate and Cisco edge appliances across manufacturing, healthcare, and financial services. The May 4, 2026 internal leak exposed the group's full operator roster, toolchain, and IOCs, giving defenders a brief intelligence advantage before the group rebrands. Three actions to complete before end of day: patch FortiGate for CVE-2024-55591 and disable NTLMv1 today; load the leaked SHA-256 hashes and YARA rules into your EDR platform; and audit backup infrastructure for unauthorized access paths. If README-GENTLEMEN.txt exists anywhere on your network, isolate the affected host immediately.
Frequently asked questions
What is The Gentlemen ransomware?
The Gentlemen ransomware is a ransomware-as-a-service (RaaS) operation launched in September 2025 by a Russian-speaking administrator known as zeta88. It ranked as the second most active ransomware program globally in the first five months of 2026, with 332 confirmed published victims. The group operates as a criminal franchise: a core developer provides the locker malware, admin panel, and infrastructure, while affiliates conduct network intrusions and split ransom proceeds 90/10 in favor of the affiliate.
How does The Gentlemen ransomware gain initial access to networks?
The Gentlemen ransomware gains initial access by targeting internet-facing Fortinet FortiGate VPN appliances and Cisco edge devices. Operator qbit maintains a live HTML dashboard tracking thousands of FortiGate panels with direct login links. The group exploits CVE-2024-55591 (FortiOS management interface), CVE-2025-32433 (Erlang SSH), and CVE-2025-33073 (NTLM relay) on unpatched devices. Where CVEs are unavailable, affiliates brute-force VPN and web admin panels using credentials harvested from public breach databases.
Which industries and sectors does The Gentlemen ransomware target?
The Gentlemen ransomware targets manufacturing, technology, healthcare, financial services, consumer goods, professional services, and real estate, with confirmed victims across more than 20 industries. Only 13% of confirmed victims are US-based. Significant victim concentrations exist in the United Kingdom, Brazil, Germany, India, Thailand, France, and Japan. The group conducts indiscriminate targeting of any organization with unpatched internet-facing edge appliances, with no sector exclusions documented.
What CVEs does The Gentlemen ransomware exploit?
The Gentlemen ransomware actively exploits three CVEs as primary attack vectors: CVE-2024-55591, an authentication bypass in the FortiOS management interface; CVE-2025-32433, a remote code execution flaw in Erlang SSH; and CVE-2025-33073, an NTLM relay vulnerability used for privilege escalation inside compromised networks. Organizations should confirm patches for all three CVEs are applied across all internet-facing edge infrastructure before any other defensive steps.
How can I detect The Gentlemen ransomware on my network?
To detect The Gentlemen ransomware, search for the ransom note file README-GENTLEMEN.txt and wallpaper gentlemen.bmp on all endpoints and file shares. In SIEM and EDR, alert on ETW event logging disabled system-wide, outbound Cloudflare WARP connections from non-IT endpoints, NTLM relay scanning signatures from internal hosts, and Group Policy Object modifications adding unknown startup executables. Load the three confirmed SHA-256 hashes from the Check Point Research leak analysis into your threat intelligence platform for hash-based detection.
Is The Gentlemen ransomware still active in May 2026?
Yes. As of May 2026, The Gentlemen ransomware is confirmed active and ranked the second most prolific ransomware operation globally. The CYFIRMA May 15, 2026 Weekly Intelligence Report documents ongoing victim additions across multiple sectors. The May 4, 2026 internal data leak exposed operational details but did not interrupt the group's campaigns. A rebranding or infrastructure pivot is anticipated in the coming weeks as the leak's damage becomes apparent to the operators.
What did The Gentlemen ransomware internal data leak reveal?
The May 4, 2026 leak of The Gentlemen's internal 'Rocket' database exposed nine named operators with distinct roles, a botnet of 1,570 victims on one affiliate's C2 server, detailed ransom negotiation transcripts showing $250,000 initial demands and $190,000 settlements, the full toolchain including EDRStartupHinder and gfreeze, a live FortiGate tracking dashboard, and Bitcoin laundering chains. The full leak totals 16.22 GB. Check Point Research published a detailed analysis including SHA-256 hashes, YARA rules, and MITRE ATT&CK mappings.
How can organizations defend against The Gentlemen ransomware attack?
Defending against The Gentlemen ransomware requires patching FortiGate for CVE-2024-55591, CVE-2025-32433 on Erlang SSH infrastructure, and CVE-2025-33073 as the first priority. Disable NTLMv1 via Group Policy. Audit and remove unauthorized Cloudflare Zero Trust tunnel registrations. Move backup infrastructure behind dedicated management VLANs with rotated credentials. Deploy the published YARA rules and SHA-256 hashes into EDR platforms. Run an immediate file system sweep for README-GENTLEMEN.txt. Any organization finding this file should isolate affected hosts immediately and initiate incident response.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.
The Mythos Brief is free.
AI that finds 27-year-old zero-days. What it means for your security program.