Leaked Rocket Database Reveals The Gentlemen Ransomware Group’s Operations
Summary
Check Point Research analyzed a reported 16 GB leak of The Gentlemen’s Rocket database, detailing the group’s structure, tools, edge-device exploitation, NTLM relay workflows, AI use, and an alleged UK-to-Turkey intrusion.
Key points
- Check Point Research analyzed a reported 16 GB cache of chats, server logs, and transaction histories from The Gentlemen’s Rocket backend.
- The analysis says the leak exposed nine accounts, including administrator zeta88, who reportedly managed infrastructure, the ransomware panel, and payouts.
- Researchers describe access involving Fortinet and Cisco edge appliances, plus backup and management-controller abuse and NTLM relay workflows.
- The article says operators discussed using CVE-2025-33073 for NTLM reflection attacks and tracked CVE-2024-55591 and CVE-2025-32433.
- The reported toolkit included ZeroPulse, NetExec, RelayKing, and the custom EDR-evasion tool gfreeze.
- The leak reportedly documented an intrusion involving a UK software consultancy and a Turkish company, with the consultancy’s project documents used against the latter.
- The article says the group used double extortion and affiliate profit sharing; it also reports the administrator’s claimed use of AI tools in development and stolen-data triage.
Article Details
- Attack Vectors
- Exploitation of exposed Fortinet and Cisco edge appliances for initial access.
- NTLM relay and reflection workflows, including use of RelayKing to map vulnerable domain targets.
- Use of internal project documents stolen from a UK software consultancy to facilitate a subsequent breach of a Turkish company.
- Double extortion using stolen data and pressure on both victim organizations.
- Defensive Notes
- Harden internet-facing services and remediate edge-device misconfigurations.
- Track and remediate relevant vulnerabilities, including CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073.
- Monitor for the tools and workflows described in the leaked data, including ZeroPulse, NetExec, gfreeze, and RelayKing.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe group reportedly gained initial access by exploiting Fortinet and Cisco edge appliances.T1557 · Adversary-in-the-MiddleOperators discussed NTLM relay workflows and weaponizing CVE-2025-33073 for NTLM reflection attacks.T1562.001 · Disable or Modify ToolsThe group used custom-built EDR evasion tools, including gfreeze.
CVE
Threat Actors
hastalamuerteThe article identifies hastalamuerte as an alias of zeta88, the administrator of The Gentlemen’s RaaS operation.The GentlemenThe article identifies this RaaS group as operating the ransomware and extortion activity described.zeta88The article identifies zeta88 as the administrator of The Gentlemen’s RaaS infrastructure, locker, panel, and payouts.
Vendors
Products
Tools
Countries
TurkeyThe leak contained a detailed case study of a double-breach involving a UK software consultancy and a subsequent victim in Turkey.United KingdomNTLM relay workflows, AI-assisted tooling, and aggressive double-extortion tactics across victims such as a UK software consultancy and a Turkish company.