The Gentlemen Ransomware Group Scales Through Affiliates and Pre-Compromised FortiGate Access
Summary
The Russian-speaking Gentlemen ransomware operation has rapidly expanded since splitting from Qilin, using an affiliate-friendly platform and a reported pool of pre-compromised FortiGate devices and VPN credentials to enable intrusions.
Key points
- The financially motivated RaaS operation reportedly split from Qilin’s affiliate programme in July 2025 and grew to 269 victims in Q2 2026.
- The group’s platform bundles encryption and self-propagation tools with an operator-maintained EDR-killer service to lower the barrier for affiliates.
- The report estimates a centrally maintained pool of 14,700 pre-compromised FortiGate devices and 969 validated FortiGate VPN credentials obtained through brute-force attacks.
- Observed intrusions rely on known vulnerabilities and public proof-of-concept exploits; the report identifies no zero-day capability.
- Targeting is described as opportunistic and revenue-driven. Manufacturing is the most consistently targeted sector, and at least six Belgian victims were confirmed.
- A May 2026 leak of the group’s backend reportedly exposed about nine named operators, a 90/10 revenue split, relationships with initial access brokers, and a chain-victimisation technique.
Article Details
- Attack Vectors
- Brute-force attacks against FortiGate VPN credentials; validated credentials were distributed to affiliates for initial access.
- Use of known n-day vulnerabilities and public proof-of-concept exploits; the article reports no identified zero-day capability.
- A centrally maintained pool of pre-compromised FortiGate devices was distributed to affiliates for initial access.
MITRE ATT&CK
Threat Actors
Products
Countries
Belgiumand the United States is proportionally under-represented relative to ransomware-ecosystem norms. Belgium has at least six confirmed named victims, though this figure is likely still an undercount.Russiathat The Gentlemen is an independently operating, financially motivated criminal enterprise based in Russia or a Russian-speaking CIS jurisdiction. The group’s activity is likely tolerated or informally encouragedUnited Statesthan fixed by sector or country. Manufacturing is the most consistently targeted sector, and the United States is proportionally under-represented relative to ransomware-ecosystem norms. Belgium has at least six
Industries
Critical infrastructurea confirmed footprint of at least six Belgian victims in 2026 and has demonstrated an impact on critical infrastructure elsewhere in the European Union. Its threat comes less from technical novelty than from anManufacturing- Victimology: Targeting is opportunistic and revenue-driven rather than fixed by sector or country. Manufacturing is the most consistently targeted sector, and the United States is proportionally under-represented