Your FortiGate may already be in their database. Since emerging in September 2025, a ransomware group known as The Gentlemen has quietly built one of the most industrialised threat operations in the ransomware ecosystem — and at the heart of their methodology is a catalogue of approximately 14,700 compromised FortiGate devices, waiting to be converted into ransomware deployment points. With over 480 confirmed victims across more than 50 countries and a Ransomware-as-a-Service (RaaS) affiliate model that offers an unprecedented 90% revenue share, The Gentlemen represent a sustained, structurally novel threat to every enterprise running Fortinet infrastructure.

This is not a story about a single CVE. It is a story about what happens when a sophisticated threat actor turns your edge security appliances into their own pre-positioned attack infrastructure — and why FortiGate administrators need to treat credential hygiene and firmware currency as life-or-death operational priorities right now.

Key Takeaways

  • The Gentlemen ransomware group emerged in September 2025 and rapidly became one of the most active RaaS operations of 2026 with 480+ confirmed victims across 50+ countries.
  • Their primary initial access vector is FortiGate exploitation — specifically leveraging CVE-2024-55591 (FortiOS authentication bypass) and a catalogue of ~14,700 pre-compromised FortiGate devices and 969 brute-forced VPN credentials.
  • The group offers affiliates a 90% revenue share — far above the industry norm of 70-80% — driving rapid affiliate recruitment and attack volume.
  • The ransomware is cross-platform: it encrypts Windows, Linux, ESXi hypervisors, and NAS devices in a single campaign, maximising business disruption.
  • Post-compromise dwell time is extended; the group uses Nmap, AD enumeration tools, and Living-off-the-Land binaries for lateral movement before deploying encryption.
  • A May 2026 internal data breach leaked ~16 GB of the group’s operational data — providing defenders and researchers with rare insight into their methodology.
  • Immediate defensive actions: patch CVE-2024-55591, audit all FortiGate management interface access, rotate VPN credentials, and check FortiGuard for IoCs.

Who Are The Gentlemen?

The Gentlemen ransomware operation emerged in September 2025. Within months, they had accumulated a victim count that put established groups to shame. By mid-2026, they were being tracked as one of the second most active ransomware operations globally by victim volume, behind only larger, more established groups.

Their internal model is built for scale. The group operates on a Ransomware-as-a-Service model, recruiting affiliates who conduct intrusions, deploy the ransomware, and manage victim negotiations. The differentiation is their affiliate economics: The Gentlemen offer a 90% revenue share to affiliates versus the typical 70–80% seen in competing operations. This aggressive cut attracts high-quality affiliates who might otherwise operate independently, creating a virtuous cycle of attack volume and sophistication.

The group’s leadership is reportedly Russian-speaking. Threat intelligence vendor PRODAFT identified internal handles including hastalamuerte and zeta88 as operators. Intelligence from a May 2026 breach of the group’s hosting infrastructure leaked approximately 16 GB of operational data — including affiliate panel data, victim communications, and tooling — giving researchers unprecedented visibility into how the operation functions from the inside.

The FortiGate Angle: 14,700 Pre-Compromised Devices

What makes The Gentlemen particularly dangerous for Fortinet-heavy environments is not just that they exploit FortiGate — it is how systematically they do it.

Analysis of a seized SystemBC command-and-control server associated with the group revealed a database containing approximately 14,700 FortiGate devices that the group has already compromised and catalogued. This is not a list of targets to attack — it is a list of devices where the attacker already has valid credentials or persistent access, waiting to be activated for a ransomware campaign. Alongside the device catalogue, the server contained 969 brute-forced FortiGate VPN credentials, published as part of a broader credential dump in April 2026.

The group’s primary documented vulnerability for initial FortiGate exploitation is CVE-2024-55591:

Detail Value
CVE ID CVE-2024-55591
Product FortiOS and FortiProxy
Type Authentication Bypass (CWE-288)
CVSS Score 9.6 (Critical)
Impact Unauthenticated super-admin privilege on the management interface
Disclosure / Exploitation January 2025 — exploited in the wild before patch
Patch Status Fixed in FortiOS 7.0.17, 7.2.11, 7.4.7, 7.6.2; FortiProxy 7.0.20, 7.2.14

CVE-2024-55591 allowed an unauthenticated attacker to send crafted requests to the Node.js WebSocket module on the management interface and gain super-admin access without credentials. If your FortiGate firmware was not patched in early 2025, your device may already be in The Gentlemen’s database without your knowledge.

Beyond CVE-2024-55591, the group supplements their device catalogue with infostealer logs and credential markets, purchasing stolen FortiGate admin and VPN credentials harvested from employee workstations by commodity malware like RedLine, Lumma, and Vidar. This multi-vector approach means that even fully patched devices can be compromised if credential hygiene is poor.

The Attack Lifecycle: From FortiGate to Encrypted Enterprise

The Gentlemen’s operational playbook, as revealed by the May 2026 leak and threat intelligence vendor analysis, follows a structured kill chain:

  1. Initial Access via FortiGate: Affiliates either select a pre-compromised device from the catalogue, use brute-forced VPN credentials to establish a tunnel, or exploit a known FortiOS vulnerability to gain management access. FortiGate provides the ideal pivot point — it is trusted by internal network segments, sits at the network boundary, and often has broad routing access.
  2. Internal Reconnaissance: Once inside the network perimeter, affiliates deploy standard tools: Nmap for host discovery and port scanning, Active Directory enumeration scripts (ADFind, BloodHound) to map domain structure, and Cobalt Strike or similar C2 frameworks for persistent access. This phase can last days to weeks.
  3. Credential Harvesting: Using tools like Mimikatz or LSASS dumping, affiliates harvest domain credentials — including domain administrator accounts — to ensure they can reach and encrypt the highest-value systems including domain controllers, backup servers, and file servers.
  4. Payload Staging and Deployment: The Gentlemen ransomware is cross-platform, with builds for Windows, Linux, VMware ESXi hypervisors, and NAS devices. Deploying all variants simultaneously maximises encryption coverage and business disruption. ESXi encryption is particularly damaging because it takes down all virtual machines simultaneously, including backups that may reside on the same virtualisation platform.
  5. Ransom and Exfiltration: Double extortion is standard — data is exfiltrated before encryption, ensuring victims face both the business disruption of encrypted systems and the threat of sensitive data being published on The Gentlemen’s Tor leak site if ransom is not paid.

Why Indian Enterprises Are at Elevated Risk

India’s enterprise sector has one of the highest concentrations of Fortinet deployments in the Asia-Pacific region. FortiGate is the dominant firewall and VPN platform across BFSI, manufacturing, pharmaceutical, and government sectors. This concentration makes Indian enterprises a high-value target for any threat group whose initial access methodology centres on FortiGate exploitation.

Several structural factors amplify the risk:

  • Delayed patch cycles: Many Indian enterprises operate FortiGate on extended maintenance windows — quarterly or semi-annual patching — meaning devices running firmware from late 2024 may still be unpatched against CVE-2024-55591 even today in late 2026.
  • Default or weak VPN credentials: FortiGate SSL-VPN deployments frequently go live with default or simple credentials and are never rotated. The 969 brute-forced credentials in The Gentlemen’s database likely include many from exactly this scenario.
  • ESXi concentration: Indian data centres and enterprise IT environments commonly run VMware ESXi for server virtualisation. The Gentlemen’s ESXi encryption capability makes these environments particularly vulnerable to total disruption.
  • Backup exposure: Backups stored on NAS devices or on the same virtualisation infrastructure as production systems are within The Gentlemen’s encryption scope, eliminating the “just restore from backup” recovery option without prior preparation.

India’s CERT-In has documented ransomware as the leading cyber threat to Indian organisations for multiple consecutive years. The Gentlemen, with their FortiGate-first methodology, are particularly well-positioned to capitalise on unpatched or misconfigured Fortinet infrastructure.

This risk is compounded by recent Fortinet vulnerabilities covered on this blog: see our analysis of FortiBleed: FBI Warns 86,644 FortiGate Firewalls Compromised and our deep dive on the FortiMail zero-day CVE-2026-104286 — both illustrate the sustained attacker focus on Fortinet infrastructure.

What You Should Do Right Now

Immediate (Within 24 Hours)

  1. Check your FortiOS firmware version. If any device in your environment runs FortiOS below 7.0.17, 7.2.11, 7.4.7, or 7.6.2, it is vulnerable to CVE-2024-55591. Treat it as potentially already compromised.
  2. Audit management interface access logs. Review FortiGate authentication logs for any super-admin sessions from unexpected source IPs, unexpected times, or unusual API-based access patterns. CVE-2024-55591 exploitation often appears as WebSocket connections to the management plane from external IPs.
  3. Rotate all FortiGate admin and SSL-VPN credentials immediately. This includes local admin accounts, RADIUS/LDAP-integrated accounts used for VPN, and any service accounts with FortiGate management access. Do not reuse previously exposed credentials.

Short-Term (Within 72 Hours)

  1. Apply CVE-2024-55591 patches if not already done. Upgrade to the fixed firmware versions across all affected FortiGate and FortiProxy devices. If you cannot patch immediately, restrict management interface access to trusted management IP ranges only — this significantly limits exploitability.
  2. Conduct a compromise assessment on FortiGate devices. Check for unfamiliar local admin accounts, unexpected VIP/policy changes, new SSL-VPN users, or modifications to administrative settings made during unplanned windows. These are common persistence mechanisms after CVE-2024-55591 exploitation.
  3. Segment and monitor east-west traffic. If an attacker compromises a FortiGate-connected host, east-west traffic monitoring is what catches lateral movement before the ransomware payload deploys. Implement micro-segmentation on critical server segments and alert on unusual scanning or credential-use patterns from workstation subnets.
  4. Protect backups from ransomware scope. Ensure backup repositories are: (a) not accessible from domain admin credentials (use a separate backup admin account), (b) isolated from the production VMware/NAS infrastructure, and (c) tested regularly for restore capability. The 3-2-1-1 backup rule (3 copies, 2 media types, 1 off-site, 1 air-gapped/offline) is the target state.

Strategic (Within 30 Days)

  1. Implement FortiGate-specific detection rules in your SIEM. FortiAnalyzer and third-party SIEM platforms can alert on the specific IoCs associated with The Gentlemen’s TTPs: unusual WebSocket connections to the management interface, super-admin creations outside change windows, sudden bulk firewall policy changes, and outbound connections to known The Gentlemen C2 infrastructure.
  2. Zero-trust your edge device management. Management interfaces for FortiGate and all other edge devices should be on out-of-band management networks, accessible only from dedicated jump hosts with MFA, and never Internet-facing. This is a foundational zero-trust principle that eliminates the management-plane attack surface entirely.
  3. Tabletop a ransomware response exercise. Your IR plan should specifically cover the scenario of ransomware reaching ESXi hypervisors — including mass VM shutdown, ESXi-level recovery, and the process for engaging your forensic partner and cyber insurer within the first four hours of discovery.

Frequently Asked Questions

We patched CVE-2024-55591 in early 2025. Are we safe from The Gentlemen?

Patching CVE-2024-55591 closes that specific initial access vector, but The Gentlemen also use brute-forced VPN credentials and infostealer logs as alternative entry points. A device that was compromised before you patched may still have persistent backdoor access (rogue admin accounts, modified policies) that survives the firmware upgrade. Patching is necessary but not sufficient — it should be paired with a post-patch compromise assessment and a credential rotation exercise.

The Gentlemen’s data breach in May 2026 — does that mean they’re disrupted?

No. The group publicly confirmed that their core ransomware infrastructure, control panel, and locker binaries were not affected by the breach. The leaked data (approximately 16 GB) was operational data from the affiliate layer rather than the core infrastructure. The breach provided valuable intelligence for threat researchers but did not meaningfully disrupt the group’s operations. They have continued to operate and claim new victims following the leak.

Our FortiGate VPN is MFA-protected. Does that protect against brute-force credential theft?

MFA on FortiGate SSL-VPN significantly raises the bar for brute-force and credential-stuffing attacks — any credential stolen via infostealer malware cannot be used alone if MFA is enforced. This is a strong control and should be in place on every FortiGate SSL-VPN deployment. However, MFA does not protect the management interface from CVE-2024-55591 (an authentication bypass, not a credential attack), and it does not protect against an attacker who has already compromised the FortiGate through the management plane. Defence in depth is required.

How do we know if our FortiGate is in The Gentlemen’s 14,700-device catalogue?

There is no public lookup service for the specific device catalogue. The practical test is to conduct a thorough compromise assessment: review all admin accounts for unexplained additions, check authentication logs for the indicators described above, verify firewall policy integrity against your change management records, and run a FortiGuard IoC check against known The Gentlemen infrastructure. If you see unexplained administrative changes in a period when you know CVE-2024-55591 was unpatched, treat the device as compromised until proven otherwise.

Authoritative Resources

Your FortiGate Is Either Hardened or It Is Their Staging Ground

The Gentlemen ransomware group has demonstrated something important: FortiGate devices are not just potential victims — they are potential weapons, turned against the organisations they are meant to protect. A compromised FortiGate sitting at the network boundary is the perfect ransomware delivery platform: it has trusted access to all internal segments, is often overlooked in endpoint monitoring, and provides persistent, stealthy access that can wait months before being activated for a destructive campaign.

Defending against this threat is not complicated — but it requires discipline: current firmware, rotated credentials, restricted management access, and a zero-trust posture that treats every edge device as a potential threat surface rather than a trusted element. If you need a rapid FortiGate security audit, a full compromise assessment of your Fortinet environment, or a zero-trust network redesign to eliminate edge-device management exposure, reach out for a consultation today. The organisations that The Gentlemen have not yet attacked are the ones that gave an attacker no easy entry point.