Gentlemen RaaS Exploits Fortinet and Cisco Edge Devices for Initial Access

The Gentlemen ransomware-as-a-service (RaaS) operation is turning exposed Fortinet and Cisco edge devices into a fast lane into enterprise networks and doing it at scale.

What began as a rising RaaS brand in mid‑2025 has, by early 2026, evolved into one of the most active programs on the underground, with hundreds of victims and a mature playbook built around edge appliance compromise, NTLM relay abuse, and aggressive EDR evasion.

Affiliates scan for exposed Fortinet VPNs and other edge devices. Either brute‑force credentials against web or VPN panels, exploit known vulnerabilities, or buy ready‑made access from bot and access brokers.

Leaked internal chats show that The Gentlemen’s operators “usually” gain initial access through internet‑facing VPN appliances, firewalls, and management interfaces, with Fortinet FortiGate and Cisco platforms singled out as high‑value targets.

Affiliates scan for exposed Fortinet VPNs and other edge devices. Either brute‑force credentials against web or VPN panels, exploit known vulnerabilities, or buy ready‑made access from bot and access brokers.

Checkpoint reveals that based on victims listed on the data leak site (DLS), The Gentlemen appears to be one of the most active RaaS programs.

In parallel, the group tracks specific vulnerabilities that fit this strategy, including CVE‑2024‑55591, which affects the FortiOS management interface, and CVE‑2025‑32433, an Erlang SSH flaw evaluated in the context of Cisco and Erlang‑based SSH services.

Operators actively exchange proof‑of‑concept exploits and debate their quality and reliability before using them against exposed edge services, treating these bugs as just another input into a well‑defined initial access pipeline.

Once a Fortinet or Cisco device is compromised, it is treated as a pivot for further intrusion rather than an end goal.

The leak ties this ecosystem to a compact but organized core of at least nine named operators and eight distinct affiliate TOX IDs, all centered on an administrator known as “zeta88” (also “hastalamuerte”).

The Gentlemen’s operators move inward from the perimeter, using VPN access or device‑side credentials to reach domain‑joined systems, escalate privileges, and begin internal reconnaissance against Active Directory, file shares, and backup infrastructure.

Fortinet and Cisco Edge Devices Exploited

The leaked Rocket backend data and chat logs provide a rare, end‑to‑end view of a modern RaaS workflow. After the edge foothold, operators run a structured sequence: Active Directory mapping, certificate and NTLM relay checks, local privilege escalation, and EDR/AV tampering.

Tools like NetExec, RelayKing, PrivHound, CertiHound, and TaskHound are used to identify relayable paths, abuse AD CS, and convert misconfigurations into domain‑level access.

NTLM relay is a recurring theme. The group specifically scans for CVE‑2025‑33073 an NTLM reflection/relay issue using RelayKing output to feed targets into tools like ntlmrelayx, turning legacy authentication exposure into practical access paths.

At the same time, they invest heavily in EDR bypass, deploying dedicated “EDR killer” sets such as EDRStartupHinder, gfreeze, and glinker, alongside techniques inspired by public ETW and logging abuse research, to blind defenders before ransomware is launched.

With defenses weakened, the Gentlemen focus on lateral movement and data theft. They establish Cloudflare‑based tunnels and custom VPN setups for stable command‑and‑control, then target NAS devices, virtualization hosts, and backup systems for large‑scale exfiltration.

Only once critical data and access are secured do they deploy their custom locker, designed to spread via existing admin sessions and Group Policy‑based mechanisms for maximum impact.the same account posted two MediaFire links containing proof files supporting the claimed leak.

This admin not only builds the locker, Gentlemen RaaS panel, and spread modules, but also personally runs some intrusions, manages payouts, and coordinates multimillion‑dollar ransom negotiations.

Key operators like “qbit” specialize in scanning Fortinet VPNs and other edge devices, while “quant” focuses on log‑based OWA/O365 credential access and high‑value brute‑force operations.

Their infrastructure and toolset are tuned for repeat use. ZeroPulse, Velociraptor, Cloudflare tunnels, WireGuard, and OpenVPN scripts underpin access and C2, while OSINT helpers, password‑cracking services, and browser‑session dumping utilities streamline credential theft and reuse.

Financially, The Gentlemen run an aggressive 90/10 split favoring affiliates, then rely on non‑custodial wallets and OTC cash‑out methods to launder proceeds while attempting to dodge AML scrutiny.

For defenders, the message is clear: exposed Fortinet and Cisco edge devices are not just perimeter risks, but the preferred front door for a highly active RaaS franchise.

Closing that door by patching management interfaces, hardening VPN authentication, and eliminating NTLM relay paths is now a critical step in staying ahead of The Gentlemen’s playbook.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.