Check Point Research Maps The Gentlemen Ransomware Operation Through Leaked Chats
Summary
Check Point Research analyzed a partial leak of The Gentlemen's Rocket backend and chats, linking nine accounts and eight affiliate TOX IDs while documenting alleged access workflows, exploit tracking, and a reported $190,000 ransom settlement.
Key points
- The Gentlemen's administrator acknowledged the Rocket backend leak on May 4, 2026; researchers obtained what they describe as a partial leak of internal chats and related data.
- The leaked material exposed nine communicating accounts. Cross-context TOX ID evidence suggests zeta88 and hastalamuerte are the same administrator, who may also have participated directly in infections.
- Chats describe alleged access methods including exposed Fortinet and Cisco appliances, credential brute-forcing, purchased access, and NTLM relay, followed by reconnaissance, evasion, lateral movement, data theft, and encryption.
- Researchers linked 29 publicly identified campaigns to eight TOX IDs; the administrator's ID appeared in four campaigns in the collected sample set.
- The group discussed CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Researchers could not confirm that targeted systems were vulnerable to the specific CVEs discussed.
- Chats indicate that data reportedly stolen from a UK consultancy was reused in an operation against a company in Turkey; the article attributes this account to the leaked discussions.
- Leaked negotiation screenshots reportedly show a $190,000 settlement after an initial $250,000 demand.
Article Details
- Attack Vectors
- Leaked chats indicate the group sought initial access through exposed Fortinet and Cisco edge appliances, including VPN and management interfaces, using credential brute-forcing, known vulnerabilities, and access obtained from brokers.
- The operators used NTLM relay workflows and searched breach-data sources for credentials; they also reused stolen OWA/M365 credentials and browser-based sessions.
- After access, they performed internal reconnaissance and privilege escalation, including Active Directory discovery, certificate abuse, and local escalation paths.
- The group used tunnels and proxies for continued access, disabled or bypassed EDR and antivirus protections, and moved laterally through victim networks.
- The operators collected credentials and data, exfiltrated files from systems including NAS and backup infrastructure, and deployed their ransomware locker to encrypt systems.
- In one reported operation, zeta88 created a backdoor Okta service account and used data stolen from a UK consultancy to support an attack against a company in Turkey.
- Defensive Notes
- Harden internet-facing services and edge devices.
- Remediate known misconfigurations and NTLM relay paths.
- Monitor for the tools and operational workflows described in the article, including EDR/AV tampering, credential collection, and ransomware deployment.
- Monitor for communication patterns and infrastructure associated with The Gentlemen, including TOX-based contacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a | Hash listed for a The Gentlemen Windows ransomware sample. |
| SHA256 | 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f | Hash listed for a The Gentlemen Windows ransomware sample. |
| SHA256 | 1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b2 | Hash listed for a The Gentlemen Windows ransomware sample. |
| SHA256 | 1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c | Hash listed for a The Gentlemen Linux ransomware sample. |
| SHA256 | 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67 | Hash listed for a The Gentlemen Windows ransomware sample. |
| SHA256 | 5dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca | Hash listed for a The Gentlemen Linux ransomware sample. |
| SHA256 | 788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19 | Hash listed for a The Gentlemen Linux ransomware sample. |
MITRE ATT&CK
T1003.003 · NTDSThe article says quant's collector used ntds.dit and SYSTEM copies to gather credential data.T1018 · Remote System DiscoveryAfter gaining a foothold, the operators performed reconnaissance across internal networks.T1021 · Remote ServicesThe article describes lateral movement using remote services, including WinRM/SMB-style tooling.T1046 · Network Service DiscoveryThe group used gogo.exe to scan common ports and exposed services.T1068 · Exploitation for Privilege EscalationThe operators pursued privilege escalation through certificate abuse and local escalation paths.T1078 · Valid AccountsThe group reused stolen OWA/M365 credentials and harvested browser-based sessions to access corporate services.T1110 · Brute ForceLeaked-chat analysis describes credential brute-forcing against web and VPN panels.T1112 · Modify RegistryRegistry abuse is described among the methods used to bypass or weaken defensive tools.T1136 · Create AccountThe article reports that zeta88 created a backdoor Okta service account during an operation.T1190 · Exploit Public-Facing ApplicationThe group reportedly targeted exposed Fortinet and Cisco edge appliances and management interfaces for initial access.T1486 · Data Encrypted for ImpactThe operators deployed The Gentlemen locker to encrypt systems across victim networks.T1555.003 · Credentials from Web BrowsersDumpBrowserSecrets was described as collecting browser cookies and secrets for session hijacking.T1557 · Adversary-in-the-MiddleThe operators scanned for and used NTLM relay paths, including checks for CVE-2025-33073.T1562.001 · Disable or Modify ToolsThe group used EDR/AV-kill packages, ETW patching, NTDLL unhooking, and other methods to disable or bypass defenses.T1572 · Protocol TunnelingThe operators used Cloudflare-based tunnels and custom VPN setups to maintain access into compromised networks.
CVE
CVE-2024-55591Fortinet · Fortios; Fortinet · FortiproxyThe leak also revealed active use of Fortinet/Cisco/NTLM relay access paths, tracking of CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, plus a ransom case that settled at 190,000 USD.CVE-2025-32433Cisco · Cloud native broadband network gateway; Cisco · Confd basic; +21 moreThe leak also revealed active use of Fortinet/Cisco/NTLM relay access paths, tracking of CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, plus a ransom case that settled at 190,000 USD.CVE-2025-33073Microsoft · Windows 10 1507; Microsoft · Windows 10 1607; +13 moreThe leak also revealed active use of Fortinet/Cisco/NTLM relay access paths, tracking of CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, plus a ransom case that settled at 190,000 USD.
Threat Actors
hastalamuerteThe article describes this handle as a likely alias of zeta88, the suspected administrator and hands-on operator of The Gentlemen, who reportedly participated in intrusions and ransomware deployment.MambaThe article identifies Mamba as an access broker who supplied Fortinet VPN access for The Gentlemen's operations.ProtagorThe article reports that Protagor participated with zeta88 in an operation against a company in Turkey and was involved in OWA-type spam.qbitLeaked chats identify qbit as an operational participant who scanned Fortinet VPNs and other edge devices, performed reconnaissance, and used NTLM relay tooling.quantLeaked chats describe quant collecting OWA/O365 credentials and developing a parser and collector for credentials and data.The GentlemenThe ransomware-as-a-service operation is reported to coordinate affiliates and conduct intrusions, data theft, extortion, and ransomware deployment.zeta88The article identifies this account as the likely administrator and operator of The Gentlemen, and reports that it personally deployed the locker and participated in intrusions. The source says zeta88 is very likely the same person as hastalamuerte.
Malware
SystemBCIn that case, the affiliate used SystemBC, and the associated commandâandâcontrol (C&C) server revealed more than 1,570 victims.The GentlemenCheck Point Research says The Gentlemen RaaS leaked its internal “Rocket” backend and chats, exposing admin zeta88/hastalamuerte, affiliate TOX IDs, infrastructure details, and negotiations.
Vendors
CiscoThe leak also revealed active use of Fortinet/Cisco/NTLM relay access paths, tracking of CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, plus a ransom case that settled at 190,000 USD.FortinetThe leak also revealed active use of Fortinet/Cisco/NTLM relay access paths, tracking of CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073, plus a ransom case that settled at 190,000 USD.Oktazeta88 ran this operation alongside Protagor, creating a backdoor Okta service account himself—typical of his intensive, handsâon involvement in many of the intrusions documented in the leaked discussions.
Products
ESXiqbit frequently requests clear EDR killer sets, manuals, and guidance for locking ESXi environments, and also brings in new bot or access suppliers (“поÑÑавÑик боÑов”) (English: “supplier of bots”).Fortinet FortiGateaccess through exposed edge devices such as VPN appliances, firewalls… platforms like Fortinet FortiGate and Cisco’]FortiOSCVE-2024-55591 – FortiOS management interfaceM365Chat logs show the group’s operational workflow, including initial access via Fortinet and Cisco appliances, NTLM relay, and stolen OWA/M365 credentials.Oktazeta88 ran this operation alongside Protagor, creating a backdoor Okta service account himself—typical of his intensive, handsâon involvement in many of the intrusions documented in the leaked discussions.OWAChat logs show the group’s operational workflow, including initial access via Fortinet and Cisco appliances, NTLM relay, and stolen OWA/M365 credentials.
Tools
CertiHoundoperations, they use a range of redâteam utilities such as NetExec, RelayKing, TaskHound, PrivHound, CertiHound, and others to perform Active Directory discovery, certificate abuse, privilege escalation, and fileDumpBrowserSecretsof tools is dedicated to EDR and AV evasion, including EDRStartupHinder, gfreeze, glinker, and DumpBrowserSecrets, as well as techniques inspired by public research on abusing Windows logging and Event Tracing forNetExec[T1021] Remote Services – They establish footholds and move through systems using VPNs, tunnels, WinRM/SMB-style tooling, and remote access frameworks [‘Cloudflare tunnels or Zero Trust solutions’, ‘NetExec (NXC)’]PrivHoundthrough Cloudflare tunnels or Zero Trust solutions), and using tools such as NetExec (NXC), RelayKing, PrivHound, and NTLM relay scanning.RegPwnMSI service abuse via RegPwn, used for privilege escalation.RelayKing-Depthhttps://github.com/depthsecurity/RelayKing-DepthTaskHound[T1053] Scheduled Task/Job – They use task-based abuse tools and persistence helpers in post-exploitation workflows [‘TaskHound’, ‘task and privilege abuse / persistence helper’]Titanishttps://github.com/trustedsec/TitanisVelociraptorFor remote access and C2, they rely on frameworks like ZeroPulse and Velociraptor, combined with Cloudflare-based tunnels and custom VPN setups to keep stable access into compromised networks.ZeroPulseFor remote access and C2, they rely on frameworks like ZeroPulse and Velociraptor, combined with Cloudflare-based tunnels and custom VPN setups to keep stable access into compromised networks.