The Gentlemen Ransomware Operation: Rapid Encryption and Expanding Threat
The Gentlemen ransomware-as-a-service (RaaS) operation, tracked as GOLD SHERWOOD, has emerged as a formidable cyber threat, capable of encrypting victim networks in under 24 hours after initial access. Researchers from Counter Threat Unit (CTU) and Sophos observed a repeatable attack playbook used by affiliates: compromising credentials, disabling defenses, stealing data, sabotaging backups, and deploying ransomware often within two days, with the fastest intrusion completing in less than a day.
Rapid Growth and Broad Targeting
The group’s leak site activity surged in 2026, listing 683 victims by July, including 169 in July alone making it the most active ransomware publication platform that month. Unlike many ransomware groups, The Gentlemen does not specialize in a single industry, instead targeting diverse sectors based on accessible vulnerabilities.
Affiliates are incentivized through a 90/10 ransom split, attracting skilled operators who bring their own access methods. Initial intrusions frequently exploit exposed Fortinet infrastructure, including:
- CVE-2024-55591 (FortiOS/FortiProxy authentication bypass)
- Brute-force attacks on FortiGate VPN services
- Compromised VPN credentials (often due to lack of multi-factor authentication)
Post-Compromise Tactics
Once inside, affiliates move swiftly, leveraging:
- Legitimate Windows tools (RDP, net commands) to escalate privileges
- Staging attack utilities in C:\PerfLogs, a directory often overlooked by defenders
- Network scanners (Advanced IP Scanner, SoftPerfect) to identify critical systems
- Credential dumping (Mimikatz, LSASS queries) for lateral movement
Defense evasion is a core focus. The group provides affiliates with GentleKiller, an EDR-killing framework that exploits vulnerable drivers to terminate 400+ security processes across 48 products. Affiliates also:
- Disable Microsoft Defender via PowerShell exclusions or registry changes
- Sabotage backups (Veeam, SQL Writer, Backup Exec) before encryption
- Use Cloudflared for persistent remote access
Data Theft and Double Extortion
The Gentlemen employs a double-extortion model, exfiltrating data before encryption. Affiliates adaptively use Rclone, Restic, and MinIO Client for data theft, depending on performance and environmental constraints.
Key Takeaways
- Speed is critical: From initial access to encryption, defenders may have less than 24 hours to respond.
- Exposed remote access (VPNs, Fortinet appliances) remains a primary entry point.
- Legitimate tools and directories (RDP, C:\PerfLogs) are exploited to evade detection.
- EDR-killing frameworks and backup sabotage are central to the group’s success.
The Gentlemen’s rapid expansion and adaptability underscore the evolving threat landscape, where unpatched vulnerabilities and weak authentication create high-risk entry points for ransomware operators.
Source: https://gbhackers.com/rapid-ransomware-deployment/
Fortinet cybersecurity rating report: https://www.rankiteo.com/company/fortinet
"id": "FOR1788424191",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Diverse sectors (no specialization)']}],
'attack_vector': ['Exposed Fortinet infrastructure',
'Brute-force attacks on FortiGate VPN services',
'Compromised VPN credentials'],
'data_breach': {'data_encryption': 'Yes (ransomware encryption)',
'data_exfiltration': 'Yes (using Rclone, Restic, and MinIO '
'Client)',
'personally_identifiable_information': 'Likely (based on '
'double extortion '
'tactics)',
'sensitivity_of_data': 'High (double extortion model)',
'type_of_data_compromised': ['Personally identifiable '
'information',
'Corporate data']},
'description': 'The Gentlemen ransomware-as-a-service (RaaS) operation, '
'tracked as GOLD SHERWOOD, has emerged as a formidable cyber '
'threat, capable of encrypting victim networks in under 24 '
'hours after initial access. Affiliates use a repeatable '
'attack playbook: compromising credentials, disabling '
'defenses, stealing data, sabotaging backups, and deploying '
'ransomware often within two days, with the fastest intrusion '
'completing in less than a day.',
'impact': {'data_compromised': 'Yes',
'operational_impact': 'Network encryption within 24 hours of '
'initial access',
'systems_affected': ['Critical systems identified via network '
'scanners',
'Backup systems (Veeam, SQL Writer, Backup '
'Exec)']},
'initial_access_broker': {'backdoors_established': 'Cloudflared for '
'persistent remote access',
'entry_point': ['Exposed Fortinet infrastructure',
'Compromised VPN credentials']},
'lessons_learned': 'Speed is critical: defenders may have less than 24 hours '
'to respond. Exposed remote access (VPNs, Fortinet '
'appliances) remains a primary entry point. Legitimate '
'tools and directories (RDP, C:\\PerfLogs) are exploited '
'to evade detection. EDR-killing frameworks and backup '
'sabotage are central to the group’s success.',
'motivation': ['Financial gain', 'Data exfiltration for double extortion'],
'post_incident_analysis': {'corrective_actions': ['Patch management for '
'critical vulnerabilities',
'Enforce MFA for all remote '
'access',
'Monitor and restrict use '
'of legitimate tools for '
'malicious purposes',
'Enhance backup security to '
'prevent sabotage'],
'root_causes': ['Unpatched vulnerabilities (e.g., '
'CVE-2024-55591)',
'Weak authentication (lack of MFA)',
'Exposed remote access services']},
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'ransomware_strain': 'The Gentlemen'},
'recommendations': ['Patch exposed Fortinet infrastructure (e.g., '
'CVE-2024-55591)',
'Enforce multi-factor authentication (MFA) for VPN '
'services',
'Monitor and restrict access to legitimate tools (RDP, '
'net commands)',
'Enhance detection for staging directories (e.g., '
'C:\\PerfLogs)',
'Implement EDR solutions resistant to driver-based '
'attacks',
'Secure backup systems to prevent sabotage'],
'references': [{'source': 'Counter Threat Unit (CTU)'}, {'source': 'Sophos'}],
'threat_actor': 'GOLD SHERWOOD (The Gentlemen RaaS)',
'title': 'The Gentlemen Ransomware Operation: Rapid Encryption and Expanding '
'Threat',
'type': 'Ransomware',
'vulnerability_exploited': ['CVE-2024-55591 (FortiOS/FortiProxy '
'authentication bypass)',
'Lack of multi-factor authentication']}