Campaign DetailSource-backed corpus

The Gentlemen RaaS Operations

The Gentlemen combines affiliate-driven ransomware with self-service access to pre-compromised FortiGate infrastructure and purchased credentials. Its operations target Windows, Linux, and ESXi systems and include data theft, encryption, security-control evasion, and downstream client compromise.

Last updated Jul 17, 2026, 12:00 PM EDT

Actor Mapping

Mapped Threat Actors

The GentlemenHastalamuerte

Targeting

Target Sectors / Countries

Cross-industryService ProvidersManufacturingTechnologyHealthcareEducation

Tradecraft

ATT&CK / Techniques

T1190T1078T1021T1486T1567T1562

Tools / Observables

Malware, Tools, CVEs

FortiGateCVE-2024-55591VPN credentialsWindows lockerLinux lockerESXi lockerBYOVDuserland EDR evasion

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

Do not treat shame-site victim counts as confirmed incident totals or infer that every affiliate uses the same access path.

Evidence Controls

Methodology / Claim Status

Reporting period: Mid-2025 through July 9, 2026
Methodology: Internal-operations leak analysis and ransomware shame-site monitoring
Sample scope: Actor operations and source-reported published-victim shares
Claim status: Tradecraft source-backed; victim volume represents published claims

IntelliOS

Related Intel Products

None Found

Citations

Source Trust / Citations

[1] Check Point: The Gentlemen internal leak analysisCheck Point Research
[2] Check Point: June 2026 ransomware landscapeCheck Point Research