Decision question

What is confirmed about this campaign, how does it gain access and create impact, who and what are in scope, what remains unknown, and which defensive actions follow from the retained evidence?[1][2]

Interpreted questions

Review access prerequisites, reachability, exploitation, affected technology, actors, victims, timeline, tradecraft, impact, attribution boundaries, mitigation, and related IntelliOS coverage.[1][2]

Initial observations

The Gentlemen combines affiliate-driven ransomware with self-service access to pre-compromised FortiGate infrastructure and purchased credentials. Its operations target Windows, Linux, and ESXi systems and include data theft, encryption, security-control evasion, and downstream client compromise.[1][2]

Evidence hierarchy and boundary

Internal-operations leak analysis and ransomware shame-site monitoring Do not treat shame-site victim counts as confirmed incident totals or infer that every affiliate uses the same access path.[1][2]

The Gentlemen combines affiliate-driven ransomware with self-service access to pre-compromised FortiGate infrastructure and purchased credentials. Its operations target Windows, Linux, and ESXi systems and include data theft, encryption, security-control evasion, and downstream client compromise.[1][2]

Cross-platform encryption, stolen-data exposure, and reuse of compromised provider information can create simultaneous business interruption, breach-response, and downstream third-party risk.[1][2]

Patch and isolate edge appliances, investigate FortiGate and VPN authentication, rotate exposed credentials, protect ESXi and immutable backups, and review service-provider access for downstream exposure.[1][2]

The Gentlemen combines affiliate-driven ransomware with self-service access to pre-compromised FortiGate infrastructure and purchased credentials. Its operations target Windows, Linux, and ESXi systems and include data theft, encryption, security-control evasion, and downstream client compromise.

The retained record scopes this as raas affiliate operations / initial-access brokerage / double extortion activity during 2025-08-01 to 2026-07-09. Cross-platform encryption, stolen-data exposure, and reuse of compromised provider information can create simultaneous business interruption, breach-response, and downstream third-party risk.[1][2]

Patch and isolate edge appliances, investigate FortiGate and VPN authentication, rotate exposed credentials, protect ESXi and immutable backups, and review service-provider access for downstream exposure.[1][2]

Confirmed reporting is separated from attribution, victim, and prevalence claims that the retained sources do not establish. Confidence: High for the Check Point-reported operating model; leak-site volumes remain source-bounded actor claims..[1][2]