Zero victims in July 2025. Third place globally by March 2026. That’s nine months. That is, by some distance, the fastest documented ascent to top-tier status in the modern RaaS era.
The Gentlemen is a ransomware-as-a-service operation that shouldn’t have been able to move this fast, except it launched with an advantage that most new groups don’t have. A pre-compiled stockpile of 14,700 already-compromised FortiGate devices, accumulated by the founder during his tenure at a different RaaS programme. Ready to deploy. No months-long initial access campaign required.
The group’s Check Point telemetry footprint tells a sharper story than the leak-site victim count: more than 1,570 victims visible in the SystemBC C2 infrastructure by early 2026, compared to the 340 publicly claimed. The public count significantly understates the operational scope. That gap isn’t unusual for RaaS operations, but the scale is notable.
How This Started: A $48,000 Dispute
The Gentlemen was founded by a threat actor operating under the alias Hastalamuerte, a Russian-speaking operator with prior documented activity as an affiliate within the Qilin ransomware programme. The proximate cause of his departure: an unpaid commission of approximately $48,000.
This is a familiar story in the ransomware ecosystem. Experienced affiliates who part ways with established programmes don’t exit the industry. They take their access inventory, their operational knowledge, and their affiliate network with them, and they found competing operations. Hastalamuerte’s transition from affiliate to operator is a case study in that dynamic.
The career path is worth understanding clearly, because it explains the structural resilience of ransomware as an ecosystem. Disrupting the brand doesn’t destroy the capability. The access inventory, the skills, and the network survive. They just reappear under a different name.
The group’s name and communications style project deliberate professionalism: structured workflows, measured victim interactions, disciplined leak-site activity. This isn’t purely cosmetic. Structured operations attract higher-quality affiliates, produce more consistent extortion outcomes, and reduce the operational security errors that lead to law enforcement interest.
The FortiGate Stockpile and Why It Changed the Timeline
Most new RaaS operations spend their first months building access inventory: scanning for vulnerable systems, exploiting them, validating credentials, assembling targets. It’s slow and resource-intensive. The Gentlemen skipped it.
The 14,700-device database of already-exploited FortiGate systems, plus approximately 969 validated brute-forced FortiGate VPN credentials, gave affiliates immediate, tested access to corporate networks across multiple geographies from day one. Affiliates could browse the inventory, select targets by geography and estimated revenue, and begin operations without the delay of initial access work.
The primary exploitation vector is CVE-2024-55591, a critical authentication bypass in Fortinet FortiOS and FortiProxy that allows unauthenticated attackers to gain super-administrator privileges. The vulnerability is the entry mechanism; the stockpile is the competitive advantage.
For any organisation running Fortinet infrastructure: a compromised FortiGate device in your environment may have been in this group’s inventory since before the group publicly launched. Active exploitation doesn’t have to be visible to be in progress. The access can predate your awareness of the group by months.
The Attack Chain
Once inside via FortiGate, operators conduct network reconnaissance to map Active Directory structure, identify high-value systems, and enumerate backup infrastructure. Cobalt Strike provides the hands-on-keyboard operator framework. SystemBC, a SOCKS5 proxy malware, provides resilient tunnelled C2 that blends with legitimate encrypted traffic.
The ransomware detonation methodology is designed for simultaneous maximum impact. Active Directory Group Policy Objects push the ransomware payload to every domain-joined system at once. The objectives: encrypt as many systems as possible before any alert is raised; overwhelm incident responders who cannot remediate dozens of simultaneously encrypted systems; eliminate any window in which backups might be identified and protected.
Before detonation, a PowerShell command disables Windows Defender and other security tooling across domain-joined systems. This is routine for the group.
Before encryption, data exfiltration. Victim data is staged in local directories (commonly C:\ProgramData\data) before exfiltration via WinSCP over SFTP or WebDAV to attacker infrastructure. The dual-extortion model provides leverage even against organisations that maintain functional backups: the threat is now data exposure, not just operational disruption.
Victim communications run exclusively through the Tox peer-to-peer encrypted messaging platform.
The BYOVD capability deserves specific attention. The group deploys ThrottleBlood.sys, a driver derived from the legitimate ThrottleStop CPU management utility, to exploit CVE-2025-7771, which grants kernel-level privileges. Once at the kernel level, the attacker can terminate protected security processes, including EDR agents that cannot be killed by standard administrative commands. The primary endpoint defence becomes unavailable at precisely the moment it’s most needed. This is not a niche technique; it’s a deliberate, effective countermeasure against mature security tooling.
The ransomware payload itself is written in Go. Cross-platform by design: it compiles to native executables for Windows, Linux, NAS, and BSD systems from a single codebase. The group encrypts not just Windows domain members but Linux-based backup servers, VMware ESXi hosts, and network-attached storage. Recovery options are a target, not an afterthought.
Who Gets Hit and Where
The targeting strategy is deliberately non-US-centric. Most established RaaS operations concentrate on North America where purchasing power is highest but law enforcement attention is also most intense. The Gentlemen targeted that gap.
Asia accounted for approximately 46% of all victims, a deliberate regional concentration. The United States and Thailand led individual victim counts. Total spread: 17 countries across North America, Europe, Asia, and the Middle East.
Manufacturing is the most affected sector: large, interconnected Windows domain environments where GPO detonation achieves maximum simultaneous coverage and operational disruption creates strong payment pressure. Technology companies, healthcare organisations, financial services firms, and construction companies round out the sector distribution.
The sector emphasis reflects a technical preference as much as a strategic one. Large Active Directory domains are where the GPO detonation technique pays off. Fragmented environments are less attractive.
The Internal Breach
In early 2026, The Gentlemen’s own operations were partially exposed by an internal breach: victim lists, affiliate communications, and internal infrastructure details leaked to security researchers. The group’s operations continued without material interruption. But the visibility it provided into TTPs and affiliate network structure was significant, and the research documenting this group benefits from it.
The Defensive Priorities
FortiGate patching and integrity verification. CVE-2024-55591 and predecessor Fortinet vulnerabilities are the primary access vector. Every organisation running FortiOS or FortiProxy should be at current patch levels. Beyond patching, conduct active integrity checks: unexpected administrator accounts, unusual configuration changes, signs of exploitation. The possibility that your device is already in the access stockpile means the baseline question is not “am I vulnerable?” but “have I already been compromised?”
BYOVD defences need to be in place before the attack starts. The ThrottleBlood.sys technique requires Windows Defender Application Control or driver allowlisting to prevent loading of the vulnerable driver. Apply Microsoft’s recommended block rules for known vulnerable drivers. Verify that EDR tamper protection cannot be defeated at the kernel level by testing it, not assuming it works.
Group Policy change monitoring. Alerting on unexpected GPO creation or modification, particularly GPOs pushing scripts or executables, is essential. The detonation moment is preceded by a GPO creation event. That event is detectable if you’re watching for it.
Offline, immutable backups. The Go locker explicitly targets Linux backup servers and ESXi hosts. Backups that are network-accessible from domain-joined systems are part of the attack surface. Offline, immutable backups, regularly tested for recovery, stored in segmented infrastructure: these are the difference between paying a ransom and not paying one.
The Gentlemen’s ascent is a warning about a structural reality in the ransomware ecosystem: experienced operators take their access inventory with them when they leave. The access stockpile doesn’t belong to the brand; it belongs to the operator. Disrupting the brand doesn’t destroy the capability or the access. It just restarts the clock.