The Gentlemen
A ransomware-as-a-service operation that split from a Qilin affiliate program in July 2025 over a payment dispute, and within a year became the most active ransomware brand tracked on leak sites, driven by mass exploitation of a Fortinet authentication-bypass flaw and an unusually patient, research-first targeting model.
Key Judgments
The Gentlemen's core operators previously ran under the Qilin affiliate program as ArmCorp, and split off after a public $48,000 payment dispute in July 2025. The group's own admin, hastalamuerte, effectively admitted the ransomware was already in development before the split was announced.
Initial access is dominated by exploitation of CVE-2024-55591, a FortiOS/FortiProxy authentication-bypass chain, combined with brute-forcing of weak or default FortiGate VPN credentials. This is a volume play against internet-facing edge devices, not bespoke intrusion tradecraft.
The group is likely to keep expanding its exploit portfolio beyond Fortinet. Affiliate discussions reference SonicWall, Cisco ASA, and Oracle E-Business Suite as near-term targets, mirroring the mass-exploitation playbook used by Cl0p in 2025.
The group's operational security is inconsistent with its technical capability: the administrator has repeatedly exposed identifying details in public forum disputes, and a May 2026 breach of internal infrastructure leaked roughly 16 GB of operational data, including negotiation transcripts and toolchain details.
Deployment of ransomware to encryption is likely to remain fast once achieved. The group uses NETLOGON-share propagation and WMI-based self-spreading to reach domain-joined hosts near-simultaneously, so dwell-time detection matters more than post-detonation response.
These five judgments really tell one story: a technically unremarkable actor that wins through volume and consistency, not innovation. That's useful for prioritization. You get more value out of patching one Fortinet CVE and enforcing MFA than you do chasing exotic TTPs this group doesn't actually use.
Actor Profile
Origin & structure
The Gentlemen is a ransomware-as-a-service (RaaS) operation of roughly 20 core members, administered by a Russian-speaking operator known as hastalamuerte. Before branding as "The Gentlemen," the operation ran internally under the name ArmCorp as an active affiliate of the Qilin RaaS program. A Windows ransomware sample bearing The Gentlemen's own data-leak-site URL was uploaded to VirusTotal on 17 July 2025, five days before hastalamuerte publicly accused Qilin of mishandling a $48,000 affiliate payment on the RAMP underground forum. The timing indicates the independent operation was already built before the dispute became the public justification for leaving.
Targeting philosophy
Unlike smash-and-grab RaaS crews that rely on volume, The Gentlemen's affiliates are instructed to prioritize targets by revenue potential, likelihood of paying (driven by sector regulation and legal exposure), and ease of privilege escalation. Devices with LDAP-integrated VPN accounts and a large user base are preferred because domain administrator compromise is faster. Reported sectors include manufacturing, construction, healthcare, insurance, and technology, with confirmed victims spanning at least 17 countries and only about 13% concentrated in the United States.
Extortion model
The group runs standard double extortion: files are encrypted with a Golang-based, cross-platform payload (Windows, Linux, ESXi, NAS, BSD variants observed), while data is exfiltrated beforehand and held over the victim's head on a Tor-hosted leak site. Leaked internal negotiation data shows opening demands around $250,000 with typical settlements closer to $190,000.
The ArmCorp-to-Gentlemen rebrand is a good reminder that ransomware "groups" are often just the same people under a new name. Tracking individuals and infrastructure holds up better over time than tracking brands, since brands come and go but the operators tend to stick around.
Timeline of Activity
First ransomware sample surfaces
A Windows sample already containing The Gentlemen's leak-site URL is uploaded to VirusTotal, predating the public split from Qilin.
Public break from Qilin
Hastalamuerte opens an arbitration dispute on the RAMP forum accusing Qilin of withholding an affiliate payment, publicly signaling the departure.
Leak site goes public
The data-leak site becomes broadly known, with the group publishing roughly 48 victims across its first two months of public activity.
Attribution evidence surfaces
Cybereason links a hardcoded string in the ransomware binary to a prior forum post by hastalamuerte discussing anti-ransomware bypass techniques, direct forensic evidence of authorship.
Explosive growth
Victim postings surge roughly 588% quarter-over-quarter, placing the group second only to Qilin in overall volume.
Internal infrastructure leaked
An anonymous actor breaches The Gentlemen's backend "Rocket" database, leaking roughly 16 GB of internal data: operator identities, a 1,570-victim affiliate botnet list, negotiation transcripts, and tooling.
Becomes the most active ransomware brand
The group posts 300 victims for the quarter, narrowly overtaking Qilin (289) to become the most active ransomware operation tracked on leak sites.
Laid out like this, the pattern is pretty clear: a quiet build-up, a public split, a slow burn through late 2025, then a huge jump once the FortiGate access lists matured in early 2026. Growth tracks exploit inventory almost exactly, which is a useful signal for forecasting where they go next.
Victimology
Figures below are directional, built from aggregated leak-site tracking and vendor telemetry reviewed for this assessment. Treat percentages as approximate, since the group discloses only victims who don't pay, so the true count is materially higher.
By sector approx. share of confirmed victims
By geography approx. share of confirmed victims
The sector spread is broad because it's opportunistic, not targeted. This isn't a group going after healthcare or manufacturing specifically. They're going after exposed FortiGate devices wherever they find them, and the sector numbers just reflect who happened to be running vulnerable gear.
Kill Chain & MITRE ATT&CK Mapping
The Gentlemen's affiliates are not known for novel tradecraft. The group uses well-documented techniques competently and repeatably rather than inventing new ones. That makes the kill chain useful for detection engineering: these are things a mature SOC can build alerting for today.
Initial Access
Mass exploitation of CVE-2024-55591 (FortiOS/FortiProxy authentication bypass) against internet-exposed FortiGate management interfaces, chaining an unauthenticated WebSocket connection with a parameter-abuse and race-condition flaw to reach super-admin access without any valid credential. The group maintains a running inventory of roughly 14,700 pre-compromised FortiGate devices shared with affiliates.
A separate, sizeable list of brute-forced FortiGate VPN credentials (~1,000 devices) is maintained alongside the exploited-device inventory, targeting default and weak username/password combinations on SSL-VPN portals.
Execution & Persistence
PowerShell is used to enable Windows PowerShell Web Access, disable Defender protections, and manipulate Active Directory objects. A custom Python utility parses exported Fortinet config files to harvest credentials and feeds them directly into NetExec for SMB credential-stuffing.
Creation of disguised admin accounts (naming patterns mimicking IT support, e.g. "MicrosoftSupporte") added to Domain Admins and granted database ownership on Veeam backup infrastructure specifically, a deliberate move to compromise the backup layer, not just the domain.
Scheduled tasks launch a hidden, policy-bypassing PowerShell process at system startup with SYSTEM privileges to run an exfiltration script, ensuring data theft survives reboots.
Privilege Escalation & Defense Evasion
GPOs are edited domain-wide to enable SMB, open firewall rules for file sharing, and reposition AD computer objects to force policy application across the environment.
Windows Defender is disabled via both Group Policy and direct PowerShell preference changes; kernel-level EDR/AV termination is achieved through Bring-Your-Own-Vulnerable-Driver (BYOVD), loading legitimately signed but flawed drivers (ThrottleBlood.sys, viragt64.sys) to kill security processes from a trust level most agents can't touch.
The exfiltration tool Rclone is renamed to mimic legitimate AV software (e.g. avastrclone.exe) to blend into process-monitoring baselines.
Security, Application, and System event logs, RDP logs, Defender support files, and Prefetch data are systematically wiped post-intrusion to blunt forensic reconstruction.
Credential Access & Lateral Movement
DPAPI backup keys are extracted via Impacket to unlock stored credentials; Veeam Backup & Replication credentials are specifically targeted, including exploitation of CVE-2023-27532 to pull stored connection secrets straight out of the backup product itself.
NetExec's coercion modules force authentication from domain machines (Petitpotam-style) and relay the captured NTLM credentials to escalate access.
Lateral movement relies on standard admin-share (SMB) and RDP abuse once domain credentials are obtained. Nothing exotic here, which is precisely why baseline SMB/RDP anomaly detection is effective.
Command & Control / Exfiltration
Chisel is used to tunnel a SOCKS proxy over port 443, giving C2 traffic the appearance of ordinary HTTPS and letting affiliates reach the internal network via proxychains.
Rclone (masqueraded, see above) pushes data out over SFTP to actor-controlled infrastructure prior to encryption, underpinning the double-extortion threat.
Impact
A broad service- and process-kill list specifically targets backup software (Veeam, Acronis, BackupExec), databases, and virtualization management processes before encryption. Shadow copies are deleted via vssadmin and WMIC as a final step to remove local recovery options.
Golang-based encryptor (Windows/Linux/ESXi/BSD/NAS variants) drops a README-GENTLEMEN.txt ransom note and appends a rotating custom extension (observed: .7mtzhh, .ojuopo). The binary is password-gated at execution and self-deletes via a cleanup batch script after running, limiting sample recovery for defenders.
Nothing in this kill chain requires custom malware or a novel technique, which is genuinely good news for defenders. Every phase here maps to detections most mature SOCs already have, or could stand up quickly. The hard part is coverage and speed, not sophistication.
Technical Deep Dive
Exploited & referenced CVEs
| CVE | Product | Description |
|---|---|---|
| CVE-2024-55591 | Fortinet FortiOS / FortiProxy | Authentication bypass via Node.js websocket module, chained to reach super-admin without valid credentials. |
| CVE-2023-27532 | Veeam Backup & Replication | Exposed credential extraction from the backup service's stored connection secrets. |
| CVE-2025-32463 | Sudo (Linux, <1.9.17p1) | Local privilege escalation to root. |
| CVE-2024-37085 | VMware ESXi (AD integration) | Auth bypass allowing full ESXi host takeover via AD group membership abuse ("ESX Admins" group). |
| BadSuccessor | Windows Server 2025 (dMSA) | Privilege escalation technique enabling compromise of arbitrary AD users via delegated managed service accounts. |
Tooling observed
A note on AI-assisted development
Open-source reporting indicates the group's administrator has referenced using commercial AI assistants (including ChatGPT and Gemini) during ransomware development, and has discussed local, less-restricted models as fallbacks when commercial tools decline requests. Affiliate discussions have also referenced, but not confirmed operational use of, tooling that connects AI agents to offensive security frameworks via the Model Context Protocol. Worth tracking across the ransomware ecosystem broadly. It lowers the skill floor for less technical affiliates and is likely to speed up tooling iteration across RaaS operations generally.
The CVE list here is short, and that's the point. Four of the five entries are public, patched vulnerabilities, so a disciplined patch management program on edge devices removes most of this group's leverage before they ever get a foothold.
Indicators of Compromise
File hashes and infrastructure indicators below are provided for detection-engineering and hunting purposes (SIEM/EDR ingestion). Defang network indicators before storing in ticketing systems per your org's handling standard.
File hashes (SHA-256 / MD5)
| Hash | Type | Associated artifact |
|---|---|---|
| 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2 | SHA-256 | First Windows Gentlemen sample (17 Jul 2025) |
| 3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235 | SHA-256 | Windows sample w/ hardcoded attribution string |
| 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b | SHA-256 | ChromeKB3.exe — Chrome credential extraction tool |
| d65c293efb5e6d033c83b2ac472bf0cb | MD5 | Cracked SoftPerfect Network Scanner |
| 42c062d6299ca9f76554441a29429404 | MD5 | VCENTER.ps1 — custom ESXi/vCenter disruption script |
| efd5366eb7473d6f7fb97ec7ac59f09d | MD5 | Custom Go-based keylogger (unconfirmed operational use) |
Other indicators
| Indicator | Type | Notes |
|---|---|---|
| 194[.]87[.]31[.]69 | IPv4 (defanged) | Rclone SFTP exfiltration endpoint |
| README-GENTLEMEN.txt | Filename | Ransom note dropped post-encryption |
| .7mtzhh / .ojuopo | File extension | Encrypted file suffix (rotates per campaign) |
| ThrottleBlood.sys / viragt64.sys | Driver filename | BYOVD kernel-level EDR killers |
These indicators have a short shelf life, since the group rotates file extensions and infrastructure per campaign. I'd treat the driver names and masquerading patterns, like Rclone posing as antivirus software, as more durable detection value than any single hash or IP in this list.
Detection & Mitigation Priorities
Ordered by estimated impact-to-effort ratio for a mid-sized enterprise defending against this actor's observed playbook.
- P1Patch FortiOS/FortiProxy for CVE-2024-55591 immediately and audit for existing backdoor accounts (e.g. unfamiliar local admins) if patching was delayed. This single CVE is the group's dominant initial-access vector.
- P1Enforce MFA on all SSL-VPN and remote-access portals. Brute-force against weak/default Fortinet credentials is a primary fallback initial-access path when exploitation isn't available.
- P1Move backup infrastructure off the domain and behind a dedicated management VLAN with rotated, non-domain credentials. Veeam is a named, specific target for both credential theft and service disruption.
- P2Enable driver-load monitoring / WDAC or HVCI to catch BYOVD attempts before EDR gets killed at the kernel level. Signature-based AV alone won't catch this.
- P2Alert on mass service-stop / process-kill command patterns targeting backup and database services (Veeam, Acronis, SQL, Oracle) as a pre-encryption impact indicator, not just on the encryptor itself.
- P2Baseline and alert on NETLOGON share writes and unusual WMI-based process spawning across many hosts in a short window. This is the group's domain-wide propagation mechanism.
- P3Hunt for renamed legitimate tools (e.g. Rclone masquerading as AV binaries) via binary/hash mismatch detection rather than filename allow-listing alone.
- P3Centralize and protect event log forwarding so that
wevtutil cl-style log clearing doesn't erase the only copy of forensic evidence.
If you can only act on three items here, patch the Fortinet CVE, turn on MFA everywhere, and get backup infrastructure off the domain. Everything else meaningfully reduces risk, but those three close off the paths this group actually uses to get in and finish the job.
References
- 01Hasta la vista, Hastalamuerte: An Overview of The Gentlemen's TTPsGroup-IB
- 02Unmasking The Gentlemen Ransomware: TTPs RevealedTrend Micro
- 03License to Encrypt: "The Gentlemen" Make Their MoveCybereason
- 04The Gentleman Ransomware: Defense Evasion TTPs UncoveredHuntress
- 05Ransomware Insights from Q2 2026GuidePoint / GRIT
- 06The Gentlemen ransomware group emerges as most active threat actor in Q2The Insurer
- 07The Gentlemen Ransomware: Threat Intelligence Analysis, TTPs & Detection GuideRed Piranha
- 08The Gentlemen Group: TTPs, IOCs and Defense GuidanceBMSP
- 09The Gentlemen Ransomware 2026: 332 Victims via FortiGate RaaSDecryption Digest
- 10A New Ransomware Threat Actor Emerges Every Week, Warns ReportInfosecurity Magazine
- 11HUB @ ransomNews — The GentlemenransomNews