Exploiting the Perimeter: Inside the Sophisticated Playbook of ‘The Gentlemen’ RaaS

In the rapidly evolving landscape of cybercrime, the “edge” of the network has become the primary battleground. The Gentlemen, a rising Ransomware-as-a-Service (RaaS) operation, has mastered this frontier by turning exposed Fortinet and Cisco edge devices into high-speed corridors for enterprise infiltration.

What began as a niche threat in mid-2025 has, by early 2026, matured into a prolific and highly organized criminal franchise, characterized by a systematic approach to edge appliance compromise, NTLM relay exploitation, and aggressive EDR evasion.

Recent intelligence from Checkpoint research indicates that based on victims listed on their Data Leak Site (DLS), The Gentlemen has emerged as one of the most aggressive RaaS programs currently active on the underground.

Initial Access: The Perimeter as a Pivot Point

The Gentlemen’s business model relies on a highly efficient initial access pipeline. Rather than viewing a firewall or VPN as a final destination, affiliates treat these devices as mere stepping stones. The group’s preferred targets include Fortinet FortiGate and various Cisco platforms, which are frequently targeted through a combination of brute-force attacks on web/VPN panels, the purchase of pre-existing credentials from access brokers, or the exploitation of specific vulnerabilities.

The group actively monitors and weaponizes vulnerabilities that facilitate this entry. Notable examples include CVE-2024-55591, affecting the FortiOS management interface, and CVE-2025-32433, an Erlang SSH flaw relevant to Cisco and other Erlang-based SSH services. Internal communications reveal that operators treat these bugs as standardized inputs, debating the reliability of Proof-of-Concept (PoC) exploits before deploying them at scale.

Leaked backend data paints a picture of a compact, disciplined hierarchy. The ecosystem is managed by a core group of at least nine operators and eight distinct affiliate TOX IDs, all coordinated by a lead administrator known as “zeta88” (also identified as “hastalamuerte”).

The Post-Exploitation Workflow: From Foothold to Domain Dominance

Once an edge device is compromised, the Gentlemen follow a rigorous, automated sequence of post-exploitation activities. This transition from the perimeter to the internal network is designed to move from a single device foothold to full Domain Admin privileges.

The group utilizes a sophisticated toolkit to navigate the internal environment:

• Reconnaissance & AD Mapping: Using tools like NetExec and PrivHound to map Active Directory structures.
• Identity Exploitation: Leveraging RelayKing and CertiHound to identify NTLM relayable paths and abuse Active Directory Certificate Services (AD CS). They specifically target CVE-2025-33073 to convert legacy authentication vulnerabilities into actionable access.
• EDR Neutralization: To ensure stealth, they deploy “EDR killer” modules such as EDRStartupHinder, gfreeze, and glinker. These tools utilize advanced techniques involving Event Tracing for Windows (ETW) abuse to blind security monitoring before the payload is delivered.

With defenses effectively neutralized, the attackers establish persistent Command and Control (C2) channels using Cloudflare-based tunnels and custom VPN setups. Their primary objective shifts to large-scale data exfiltration, specifically targeting NAS devices, virtualization hosts, and backup repositories to maximize leverage during negotiations.

Operational Structure and Financials

The Gentlemen operate with a high degree of specialization. While the lead admin manages the RaaS panel and multimillion-dollar ransom negotiations, specialized operators like “qbit” focus on edge-device scanning, and “quant” specializes in OWA/O365 credential theft via log-based attacks. Their infrastructure is a modular stack of modern tools, including Velociraptor, WireGuard, and ZeroPulse.

The financial model is optimized for affiliate recruitment, utilizing an aggressive 90/10 revenue split in favor of the affiliates. To evade Anti-Money Laundering (AML) detection, they rely on non-custodial wallets and over-the-counter (OTC) cash-out methods to launder the proceeds of their extortion campaigns.

Defensive Recommendations

The Gentlemen’s success is predicated on the “soft” perimeter. To mitigate the risk of this specific RaaS threat, organizations must move beyond basic firewall management and implement a defense-in-depth strategy:

• Aggressive Patch Management: Prioritize immediate patching of internet-facing management interfaces (e.g., FortiOS).
• Identity Hardening: Disable legacy authentication protocols where possible and strictly monitor for NTLM relay opportunities.
• Zero Trust Architecture: Treat edge devices as untrusted entities; ensure that a compromise of a VPN appliance does not grant immediate lateral movement capabilities via overly permissive network segmentation.
• EDR Integrity: Implement monitoring for tampering attempts against security agents, specifically looking for unauthorized modifications to ETW or service-start behaviors.