A Russian-speaking ransomware crew known as The Gentlemen has quickly risen to become one of the most active threats in 2026, ranking second only to Qilin in ransomware activity.

Their toolkit combines Fortinet vulnerability exploitation, AI-assisted operations, and a fully custom command-and-control framework that most security tools simply do not see coming.

The group operates without a central office or traditional payroll structure. Nine operator handles have been identified communicating across time zones through a self-hosted Rocket.Chat instance on an onion site, with plans to migrate to a Rust-based platform.

Their lean, distributed model marks a clear shift from the rigid corporate setup that groups like Conti once maintained.

In May 2026, the Ransom-ISAC research team extracted 3,366 messages from The Gentlemen’s Rocket.Chat server, exposing internal plans, tooling discussions, and victim targeting details.

Analysts at Vectra AI noted the findings in a report shared with Cyber Security News (CSN), observing that while the group’s tools have changed considerably, the core weaknesses they exploit in victim networks have stayed nearly the same since 2022.

The leaked messages also uncovered a connection between The Gentlemen and earlier ransomware brands. A negotiator known by the handle “Tinker” appeared in both Black Basta chats and The Gentlemen’s logs, performing the same operational role across both groups.

A shared Matrix homeserver, bestflowers247.online, was present in archives from both groups, anchoring that infrastructure link with hard evidence.

This pattern points to a larger truth: ransomware operators do not retire, they rebrand. The same people carry their knowledge and access from one criminal enterprise to the next, making group takedowns far less effective than many defenders might hope.

Gentlemen Ransomware Uses Fortinet Exploits, AI, and Custom C2 Frameworks

Fortinet remains the front door of choice for The Gentlemen. The Rocket.Chat logs mention FortiGate 81 times, with CVE-2024-55591, a FortiOS authentication bypass flaw, called out explicitly as their primary way into victim networks.

Halcyon’s separate analysis found the group brute-forcing roughly 1,000 Fortinet VPNs, in some cases using reused passwords like gentlemen25 and gentle26 across multiple victims.

Once inside, the group deploys a custom C2 framework called G-BOT. This previously undocumented control panel supports per-beacon SOCKS5 tunneling and uploads builders to temporary file-sharing sites, replacing commercial tools like Cobalt Strike.

That switch makes detection harder for security teams relying on known signatures.

The group also targets hypervisors directly. Their Linux locker attacks Hyper-V Volume Manager, encrypting at the hypervisor level so that endpoint agents inside virtual machines cannot see the attack.

The locker drops the extension .i8p14s and leaves a ransom note named README-GENTLEMEN.txt, signaling that no layer of infrastructure is off limits.

AI and Credential Theft Complete the Kill Chain

The Gentlemen have moved AI from a novelty into a working part of their operation. Operators reference using GPT and Claude models to assist with ransom negotiations, with one operator describing them as automatic response writers for victim communications.

The group also discusses renting GPUs on vast.ai and running uncensored AI models from Hugging Face to triage large volumes of stolen data.

For credential theft, the group relies on Phemedrone Stealer V2.3.2, LummaC2, XenAllPasswordPro, Chrome App-Bound Encryption Decryption, and DumpBrowserSecrets.

These tools pull saved passwords directly out of browsers without triggering login failures, meaning standard authentication logs show nothing unusual. Stolen data then moves out through rclone to MEGA, following the same exfiltration pattern ransomware groups have used for years.

Defenders have clear steps based on what the leaked chats reveal. Security teams should audit edge devices including Palo Alto, Fortinet, Citrix, F5, and Cisco gear against the CVE list discussed in operator chats.

Treating NTDS.dit and VSS backup access as an immediate severity-one alert, rather than a forensic discovery made weeks later, can stop domain-wide compromises before they fully develop.

Hunting for tools like rclone, MEGAcmd, WinSCP, and Velociraptor on hosts that have no reason to run them adds an early warning layer that logs alone cannot provide.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
CVE	CVE-2024-55591	FortiOS authentication bypass; primary initial access vector used by The Gentlemen
CVE	CVE-2024-3400	Palo Alto Networks PAN-OS zero-day; most-discussed CVE in Black Basta operator chats
CVE	CVE-2025-32433	Erlang/OTP SSH RCE; present in The Gentlemen toolkit
CVE	CVE-2025-33073	NTLM relay vulnerability; present in The Gentlemen toolkit
CVE	CVE-2023-4966	Citrix NetScaler; referenced in operator CVE discussions
CVE	CVE-2020-5135	SonicWall stack buffer overflow (CVSS 9.4); used by Conti operators
Domain	bestflowers247.online	Shared Matrix homeserver linking Black Basta and The Gentlemen operators
IP / SSH	193.228.128.2:2222	NAS staging server used in The Gentlemen rclone exfiltration pipeline
Credential	userd0wnloAd1	Username for NAS staging server used during data exfiltration
Password	gentlemen25 / Gentlemen25 / gentle26	Reused VPN passwords found across multiple Fortinet-targeted victims
File Extension	.i8p14s	File extension appended by The Gentlemen Linux/NAS locker
File Name	README-GENTLEMEN.txt	Ransom note dropped by The Gentlemen Linux locker
Tool	Phemedrone Stealer V2.3.2	Credential stealer used by The Gentlemen for browser password harvesting
Tool	LummaC2	Credential stealer / payload dropper used by both Black Basta and The Gentlemen
Tool	XenAllPasswordPro	Password recovery tool used for credential theft
Tool	DumpBrowserSecrets	Browser credential dumping tool used by The Gentlemen
Tool	Chrome App-Bound Encryption Decryption	Tool for bypassing Chrome credential protection
Tool	G-BOT	Custom C2 framework with SOCKS5 tunneling used by The Gentlemen
Tool	rclone	Data exfiltration tool used to stage stolen data to MEGA
Tool	Velociraptor	Legitimate DFIR tool repurposed by The Gentlemen as C2
File	qwertyuio.txt	File used by LummaC2 to store exfiltrated credentials (observed in Black Basta)
File	README-GENTLEMEN.txt	Ransom note filename dropped by group’s Linux locker
Path	/opt/updateamd	Linux locker binary invocation path used by The Gentlemen
Archive	JA456	Follow-on leak package exposing Gentlemen operator-side artifacts including NAS and MEGA session data
Platform	temp.sh / 0x0.st	Temporary file-sharing sites used to upload G-BOT builder payloads

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post The Gentlemen Ransomware Group Uses Fortinet Exploits, AI, and Custom C2 Frameworks appeared first on Cyber Security News.