Gentlemen Ransomware Exploits Fortinet Vulnerabilities, AI, and Custom C2

Key Takeaways

• The Russian-speaking ransomware group “The Gentlemen” employs Fortinet vulnerabilities, AI, and a custom command-and-control (C2) framework.
• Leaked internal communications reveal a highly distributed, agile operational model and a direct link to the Black Basta ransomware group through shared personnel and infrastructure.
• The group actively exploits critical Fortinet vulnerabilities, specifically CVE-2024-55591, and targets hypervisors directly to evade traditional endpoint detection.
• AI models are leveraged for automating ransom negotiations and triaging exfiltrated data, while various credential stealers are used to bypass standard authentication logs.

The Gentlemen Ransomware: A New Breed of Distributed Cybercrime

A sophisticated Russian-speaking ransomware collective, dubbed “The Gentlemen,” has emerged, utilizing a potent combination of Fortinet vulnerability exploitation, artificial intelligence (AI)-assisted operations, and a bespoke command-and-control infrastructure. This advanced toolkit enables the group to bypass conventional security measures, posing a significant threat to organizations globally.

Unlike more structured criminal enterprises, The Gentlemen operates without a centralized physical office or traditional payroll system. Research has identified nine distinct operator handles communicating across various time zones via a self-hosted Rocket.Chat instance on an onion site. Plans for migrating to a Rust-based communication platform further highlight their commitment to operational security and adaptability. This lean, distributed model represents a strategic evolution from the more rigid, corporate-like structures observed in groups such as Conti, enabling greater resilience and evasion of law enforcement efforts.

Internal Communications Expose Tactics and Links to Other Groups

In May 2026, the Ransom-ISAC research team successfully obtained 3,366 messages from The Gentlemen’s Rocket.Chat server. This trove of information exposed the group’s internal strategic discussions, tooling preferences, and detailed victim targeting methodologies. Analysts at Vectra AI, in a report shared with Cyber Security News (CSN), noted that while the group’s specific tools have advanced, the fundamental weaknesses they exploit in victim networks have remained largely consistent since 2022.

The leaked communications also unveiled a direct operational link between The Gentlemen and previous ransomware entities. A negotiator, known by the handle “Tinker,” was observed performing the same role in both Black Basta chats and The Gentlemen’s logs. Further solidifying this connection, a shared Matrix homeserver, bestflowers247.online, appeared in archives from both groups, providing concrete evidence of shared infrastructure. This pattern reinforces the observation that ransomware operators frequently rebrand rather than disband, carrying their expertise and network access across successive criminal ventures, thereby diminishing the long-term effectiveness of efforts to dismantle individual groups.

Gentlemen Ransomware Uses Fortinet Exploits, AI, and Custom C2 Frameworks

Fortinet devices serve as the primary initial access vector for The Gentlemen. The Rocket.Chat logs explicitly mention FortiGate 81 times, with CVE-2024-55591, a FortiOS authentication bypass flaw, identified as their primary entry point. Halcyon’s independent analysis further revealed the group’s brute-forcing attempts on approximately 1,000 Fortinet VPNs, sometimes employing weak or reused credentials such as “gentlemen25” and “gentle26” across multiple targets.

Upon gaining initial access, The Gentlemen deploys a proprietary C2 framework named G-BOT. This previously undocumented control panel facilitates per-beacon SOCKS5 tunneling and uploads builder payloads to ephemeral file-sharing services, a notable departure from common commercial tools like Cobalt Strike. This shift to custom tooling significantly complicates detection for security teams reliant on signature-based defenses.

The group’s attack methodologies extend to directly targeting hypervisors. Their Linux locker module specifically attacks Hyper-V Volume Manager, encrypting data at the hypervisor level. This tactic allows the ransomware to bypass endpoint agents operating within virtual machines, rendering them blind to the attack. The locker appends the extension .i8p14s to encrypted files and leaves a ransom note named README-GENTLEMEN.txt, underscoring their intent to compromise every layer of an organization’s infrastructure.

AI and Credential Theft Complete the Kill Chain

The Gentlemen has integrated AI beyond mere experimentation, making it an operational component of their attacks. Operators in the leaked chats referenced using GPT and Claude models to streamline ransom negotiations, with one operator describing them as automated response generators for victim communications. The group also discussed renting GPUs on vast.ai and deploying uncensored AI models from Hugging Face to efficiently triage and analyze large volumes of stolen data.

For credential theft, the group relies on a suite of tools including Phemedrone Stealer V2.3.2, LummaC2, XenAllPasswordPro, Chrome App-Bound Encryption Decryption, and DumpBrowserSecrets. These sophisticated tools extract saved passwords directly from browsers without triggering login failures, thus ensuring that standard authentication logs remain clean. Exfiltrated data is then transferred via rclone to MEGA, a method consistent with long-standing ransomware exfiltration patterns.

What You Should Do

• Patch and Update Fortinet Devices: Immediately apply all available patches for Fortinet products, especially addressing CVE-2024-55591 and any other vulnerabilities mentioned in the IoCs.
• Audit Edge Devices: Conduct thorough audits of all edge devices from vendors such as Fortinet, Palo Alto Networks, Citrix, F5, and Cisco against the list of CVEs discussed by the operators.
• Strengthen Authentication: Implement strong, unique passwords for all VPN and network access, and enforce multi-factor authentication (MFA) across all critical systems. Avoid reusing passwords.
• Monitor for Lateral Movement: Treat unauthorized access to NTDS.dit and VSS backups as a critical, immediate alert. Implement real-time monitoring to detect such activities before a full domain compromise occurs.
• Detect Suspicious Tools: Actively hunt for the presence of tools like rclone, MEGAcmd, WinSCP, and Velociraptor on hosts where they are not officially sanctioned or required. Their presence can be an early indicator of compromise.
• Enhance Hypervisor Security: Implement robust security measures and monitoring at the hypervisor level to detect and prevent attacks that bypass endpoint agents within virtual machines.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.