The Gentlemen Ransomware — FortiOS CVE-2024-55591 Authentication Bypass + Custom G-BOT C2 Framework
The Gentlemen Ransomware (TL-2026-0685), also tracked as The Gentlemen Ransomware Campaign, is a critical-severity ransomware operation scored CVSS 9.6, first published 2026-06-05. It is attributed to The Gentlemen with medium confidence, affects Fortinet FortiOS, references 1 CVE (CVE-2024-55591), maps to 16 MITRE ATT&CK techniques (T1021, T1046, T1071), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0685
- Threat ID
- TL-2026-0685
- Also known as
- The Gentlemen Ransomware Campaign
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-05
- Last reviewed
- 2026-06-05
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, construction, healthcare, financial, professional-services
- Target regions
- North America, Europe, Asia, Middle East
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in The Gentlemen Ransomware
Malware and tooling: The Gentlemen Linux/Hyper-V Locker, The Gentlemen Windows Locker, AnyDesk, G-BOT SOCKS5 per-beacon tunnel, Slempo
The Gentlemen ransomware group exploits FortiOS/FortiProxy authentication bypass CVE-2024-55591 (CVSS 9.6) for initial access, supplemented by brute-forced FortiGate SSL-VPN credentials. Post-exploitation pivots to a custom undocumented C2 framework (G-BOT) using per-beacon SOCKS5 tunneling in place of Cobalt Strike, and a Linux locker that encrypts Hyper-V guests at the hypervisor level to defeat in-VM endpoint agents.
How The Gentlemen Ransomware works
The Gentlemen is a double-extortion ransomware operation tracked since mid-2025 that has industrialized FortiGate edge-device compromise as its primary intrusion vector. The group's flagship initial-access technique abuses CVE-2024-55591, an authentication bypass affecting the FortiOS and FortiProxy management interface. The flaw (CWE-288, Authentication Bypass Using an Alternate Path or Channel) lets an unauthenticated remote attacker craft requests to the Node.js websocket module of the administrative interface and obtain super-admin privileges. Once authenticated, operators create randomly named local administrator accounts, add SSL-VPN users, alter firewall policy, and harvest configuration to enumerate the internal estate.
Where CVE-2024-55591 is unavailable or patched, The Gentlemen falls back to large-scale credential brute-forcing of FortiGate SSL-VPN portals; reporting attributes roughly 1,000 brute-forced VPN accounts and an inventory of approximately 14,700 compromised FortiGate devices to the campaign's infrastructure. After gaining a foothold, the group deploys G-BOT, a bespoke command-and-control framework that replaces commodity tooling such as Cobalt Strike. Each G-BOT implant establishes a dedicated per-beacon SOCKS5 tunnel back to operator infrastructure, providing interactive proxied access into the victim network while minimizing the static signatures that mature EDR fleets fingerprint for Cobalt Strike beacons and named pipes.
The Gentlemen layer living-off-the-land and signed third-party tooling over the custom C2: PsExec and PDQ Deploy for lateral movement and mass execution, AnyDesk for persistent interactive access, and BYOVD-style driver abuse plus scripted termination of security agents for defense evasion. The group has publicly emphasized AI-assisted operations to accelerate reconnaissance, scripting, and victim triage. The destructive stage is delivered by two lockers: a Windows locker for endpoint and file-server encryption, and a Linux/ESXi-class locker purpose-built to run on Hyper-V hosts and encrypt guest virtual disks from the hypervisor layer, rendering in-guest endpoint protection blind to the encryption activity. Victims are pressured through a Tor-based data-leak site as part of standard double-extortion.
MITRE ATT&CK techniques used in TL-2026-0685
Lateral Movement
Discovery
T1046 Network Service Discovery
Command and Control
T1071 Application Layer Protocol; T1090 Proxy
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
Persistence
Defense Evasion
T1211 Exploitation for Stealth
command-and-control
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Exfiltration
T1567 Exfiltration Over Web Service
Execution
defense-impairment
Affected products and versions in The Gentlemen Ransomware
- Fortinet — FortiOS
Vulnerable versions: 7.0.0 through 7.0.16
Fixed in: 7.0.17 - Fortinet — FortiProxy
Vulnerable versions: 7.0.0 through 7.0.19; 7.2.0 through 7.2.12
Fixed in: 7.0.20; 7.2.13
Remediation for The Gentlemen Ransomware
Patches
- Fortinet FG-IR-24-535 — apply fixed FortiOS/FortiProxy builds for CVE-2024-55591
Immediate actions
- Upgrade FortiOS to 7.0.17+ and FortiProxy to 7.0.20+/7.2.13+ to remediate CVE-2024-55591
- Restrict FortiGate administrative interface exposure — disable HTTP/HTTPS admin access on WAN-facing interfaces
- Audit FortiGate config for unrecognized local admin accounts, new SSL-VPN users, and altered firewall policy
- Block known G-BOT C2 IPs and domains at the perimeter and hunt for outbound SOCKS5 tunnels
Workarounds
- Disable HTTP/HTTPS administrative access or restrict to local-in trusted hosts
- Place management interface behind out-of-band network access only
Longer-term hardening
- Deploy EDR with behavioral detection across Windows, Linux, and Hyper-V hosts
- Implement network segmentation isolating hypervisor management from user VLANs
- Enforce MFA on all VPN and remote-access portals to blunt credential brute-forcing
- Centralize FortiGate logs to SIEM and alert on admin-account creation and config changes
CVEs associated with The Gentlemen Ransomware
Weaknesses (CWE) in The Gentlemen Ransomware
CWE-288
Timeline of The Gentlemen Ransomware
- Active exploitation of the FortiOS management-interface auth bypass later assigned CVE-2024-55591 observed in the wild against exposed FortiGate devices.
- Fortinet publishes PSIRT advisory FG-IR-24-535 and CVE-2024-55591 (CVSS 9.6) with fixed FortiOS/FortiProxy builds.
- watchTowr Labs releases a public proof-of-concept for the CVE-2024-55591 authentication bypass on GitHub.
- The Gentlemen ransomware operation surfaces with a Tor data-leak site and double-extortion victims across multiple sectors.
- Halcyon, Cyber Security News, and GBHackers publish coordinated threat assessments detailing The Gentlemen's FortiGate exploitation, ~14,700 compromised devices, ~1,000 brute-forced VPNs, custom G-BOT C2, and Hyper-V Linux locker.
- Threadlinqs Intelligence publishes TL-2026-0685 with full MITRE mapping, IOCs, and detection coverage.
Sources cited for The Gentlemen Ransomware
- The Gentlemen Ransomware Group Uses Fortinet Exploits, AI, and Custom C2 Frameworks
- Threat Assessment: The Gentlemen Ransomware Group
- CVE-2024-55591 (Tenable)
- watchTowr Labs — FortiOS Auth Bypass PoC CVE-2024-55591
- Gentlemen Ransomware Exploits Fortinet Flaws, AI, and Custom C2 Tools
- Fortinet PSIRT Advisory FG-IR-24-535
Threats related to The Gentlemen Ransomware
- Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation
- The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts
Detection coverage for TL-2026-0685
As of 2026-06-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0685 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.