The Gentlemen RaaS overtakes Qilin as #1 ransomware operation, wields GentleKiller EDR-killer framework (400+ processes, 8 BYOVD variants) and 90% affiliate payouts

The Gentlemen RaaS overtakes Qilin as #1 ransomware (TL-2026-1332), also tracked as Gentlemen RaaS, is a high-severity ransomware operation scored CVSS 9.6, first published 2026-07-14. It is attributed to The Gentlemen (Russia) with medium confidence, affects Fortinet FortiOS / FortiProxy, references 7 CVEs (CVE-2024-55591, CVE-2025-32433, CVE-2025-33073), maps to 42 MITRE ATT&CK techniques (T1003.004, T1021.001, T1021.002), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-1332

Threat ID
TL-2026-1332
Also known as
Gentlemen RaaS, GentleKiller campaign
Severity
HIGH
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-14
Last reviewed
2026-07-14
Attribution
The Gentlemen
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
manufacturing, technology, health, government administration, finance, professional services
Target regions
North America, Europe, germany, Global
Detection rules
9
Indicators of compromise
29

Malware and tooling in The Gentlemen RaaS overtakes Qilin as #1 ransomware

Malware and tooling: GentleKiller, The Gentlemen ransomware, AntSword, Chisel, DonPAPI, HavocKiller, HexKiller, NetExec

The Gentlemen, a ransomware-as-a-service operation founded by former Qilin affiliate hastalamuerte after a 2025 payment dispute, displaced Qilin as the #1 ransomware group in June 2026 with 121 claimed victims (vs. Qilin's 80), ending Qilin's 12-month reign. The group runs a 90% affiliate profit-share and equips affiliates with GentleKiller, an in-house BYOVD EDR-killer framework with at least eight driver variants that disables 400+ processes across 48 security vendors, alongside LLM-assisted infrastructure/code maintenance.

How The Gentlemen RaaS overtakes Qilin as #1 ransomware works

The Gentlemen (RaaS admin/founder alias 'hastalamuerte', identified by Krebs/PRODAFT as Russian national Alexander Andreevich Yapaev) emerged from the Qilin affiliate ecosystem in mid-2025. hastalamuerte previously ran a ~20-member Qilin-affiliated crew called ArmCorp and, after a public $48,000 payment-dispute arbitration against Qilin operators on the RAMP forum on 22 July 2025, spun up an independent RaaS brand. First Windows ransomware sample surfaced on VirusTotal 17 July 2025; the group's own leak site went live by early September 2025, alongside an official RaaS launch offering affiliates a 90% profit share (an unusually aggressive split versus the industry-standard 70-80%). PRODAFT has also linked Gentlemen operators to prior affiliate work with Qilin, Embargo, LockBit, Medusa, and BlackLock.

Initial access is edge-infrastructure-centric: mass exploitation of CVE-2024-55591 (FortiOS/FortiProxy authentication bypass via crafted Node.js WebSocket requests achieving super_admin), CVE-2025-32433 (unauthenticated Erlang/OTP SSH daemon RCE, CVSS 10.0), CVE-2025-33073 (Windows SMB Client), and CVE-2025-55182 (React2Shell), plus credential brute-forcing against ~1,000 additional FortiGate VPNs using an 80+ entry dictionary (including honeypot-detection garbage strings) and purchases from initial access brokers. The group maintains an internal database of ~14,700 internet-facing FortiGate devices, built via Shodan/ZoomEye reconnaissance and a cracked SoftPerfect Network Scanner.

Once inside, affiliates use NetExec for host discovery/brute force/lateral movement, DonPAPI and Impacket's dpapi.py for automated DPAPI/LSA secret extraction, a custom Python tool (userpassfort.py) to harvest Fortinet credentials, and custom PowerShell (VCENTER.ps1) to pivot into vSphere/ESXi environments. Persistence and lateral spread rely on new domain accounts (e.g. 'MicrosoftSupporte'), GPO manipulation (including privilege escalation via BadSuccessor, CVE-2025-32463, CVE-2024-37085), RDP group additions, SMB/admin-share access, and AnyDesk/MeshCentral remote-management deployment (hardcoded credentials in shared deployment scripts). Chisel is tunneled over 443 for reverse SOCKS C2, and SystemBC has been observed for auxiliary C2 traffic.

Defense evasion is anchored by GentleKiller, an in-house EDR-killer framework ESET assessed as an internal Gentlemen tool (later corroborated by Group-IB and Check Point) with at least eight distinct variants, each impersonating a legitimate security/gaming product (Kaspersky, FACEIT Anti-Cheat, Valorant, Javelin/EAAntiCheat, WatchDog, a network blocker branded as Qihoo 360, an IObit-branded 'Deletor' cleaner abusing CVE-2025-26125, and a 'G11'/Symantec-branded variant using a custom rootkit driver called PoisonX). Each variant drops and loads a distinct vulnerable or malicious kernel driver as a service (eb.sys, nseckrnl.sys, GameDriverX64.sys, stpm_old.sys/stpm_new.sys, dmx.sys, 360netmon_wfp.sys, IMFForceDelete, PoisonX) and issues DeviceIoControl/native-API IOCTLs from user mode to terminate 400+ processes mapped to 48 security vendors (Microsoft Defender, CrowdStrike, SentinelOne, Kaspersky, Bitdefender, Sophos, and more) at Ring 0, defeating user-mode tamper protection. Binaries are packed with Enigma/Themida, carry forged version info and vendor icons, and copy invalid digital signatures from legitimate executables. Affiliates additionally deploy third-party/leaked EDR killers HexKiller, ThrottleBlood (ThrottleBlood.sys), HavocKiller, viragt64.sys, and an 'EDR-Freeze' tool, plus AntSword webshells. Host-side, operators disable Windows Defender/EDR via PowerShell and GPO, modify registry keys to uninstall Bitdefender endpoint agents and redirect/disable WMI ReadyBoot and GlobalLogger event tracing, and clear Security/Application/System/RDP event logs.

Exfiltration is performed primarily via Rclone (renamed avastrclone.exe to blend in, scheduled through rclone.ps1) configured against an SFTP drop at 194.87.31[.]69:2222, with MEGA suggested as a fallback. Credential theft tooling includes a custom Chrome password stealer (ChromeKB3.exe) and Veeam credential extraction.

The ransomware itself is written in both C and Go, with Windows, Linux, and ESXi-specific variants (the ESXi locker, released 10 September 2025, kills non-whitelisted processes, deletes VM snapshots, and disables auto-start services) plus a 'GLOCKER' one-click builder for affiliate deployment. Encryptor execution requires an 8-byte password parameter (--password), supports a custom output path (--path), and — since 21 September 2025 — a delayed-execution timer (--T, in minutes) paired with WMI-based domain-wide spread. Impact operations kill 100+ processes (SQL Server, VMware, Veeam, Exchange, backup agents), delete Volume Shadow Copies via vssadmin/wmic, clear the Recycle Bin and Prefetch, replace the desktop wallpaper, drop a ransom note (README-GENTLEMEN.txt), append the .7mtzhh extension to encrypted files, and self-cleanup via batch script.

Operationally the group has scaled unusually fast: Halcyon assessed ~300 victims across 66 countries within roughly a year of independent operation; by April 2026 the group accounted for ~10% of global ransomware activity; by July 2026 cumulative claimed victims reached 580 across 77 countries (manufacturing the top vertical, 103 of 580), a 6x increase in claimed-victim volume comparing H2 2025 to H1 2026, and the group's June 2026 total of 121 claimed victims made it the #1-ranked RaaS operation, surpassing Qilin's 80 and ending Qilin's 12-month run at the top of Bitdefender's tracked leaderboard. Bitdefender additionally reports the group uses LLM assistant add-ons (screenshots confirm ChatGPT and Gemini use, with references to Claude via MCP for pentesting integration, and to Qwen/DeepSeek as less-restricted alternatives) to speed up infrastructure and code maintenance. Notable OpSec failures include hardcoded RAMP forum post text left in an encryptor binary (Cybereason), the group's own public arbitration dispute revealing its origin story, and a May 2026 insider/BreachForums-linked leak exposing Russian-speaking affiliate handles and admin details.

MITRE ATT&CK techniques used in TL-2026-1332

Credential Access

T1003.004 LSA Secrets; T1110.001 Password Guessing; T1555.003 Credentials from Web Browsers; T1557.001 Name Resolution Poisoning and SMB Relay

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.001 Invalid Code Signature; T1211 Exploitation for Stealth

Discovery

T1046 Network Service Discovery; T1087.002 Domain Account; T1615 Group Policy Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Execution

T1053 Scheduled Task/Job; T1059.001 PowerShell; T1059.006 Python; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1484.001 Group Policy Modification

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1098.007 Additional Local or Domain Groups; T1136.002 Domain Account; T1543.003 Windows Service

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686 Disable or Modify System Firewall

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

Resource Development

T1585.003 Cloud Accounts; T1587.001 Malware; T1588.006 Vulnerabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595.002 Vulnerability Scanning

Affected products and versions in The Gentlemen RaaS overtakes Qilin as #1 ransomware

  • Fortinet — FortiOS / FortiProxy
    Vulnerable versions: FortiOS 7.0.0-7.0.16; FortiProxy 7.0.0-7.0.19; FortiProxy 7.2.0-7.2.12
    Fixed in: FortiOS >7.0.16; FortiProxy >7.0.19 / >7.2.12
  • Ericsson (Erlang/OTP) — Erlang/OTP SSH daemon
    Vulnerable versions: prior to OTP-27.3.3; prior to OTP-26.2.5.11; prior to OTP-25.3.2.20
    Fixed in: OTP-27.3.3; OTP-26.2.5.11; OTP-25.3.2.20
  • Microsoft — Windows SMB Client
    Vulnerable versions: affected builds prior to CVE-2025-33073 patch
    Fixed in: patched via Microsoft security update
  • Multiple — EDR/AV agents (48 vendors incl. Microsoft Defender, CrowdStrike, SentinelOne, Kaspersky, Bitdefender, Sophos)
    Vulnerable versions: agents lacking kernel driver allow-listing/HVCI enforcement
    Fixed in: N/A - mitigated via driver blocklisting and tamper-protection hardening

Remediation for The Gentlemen RaaS overtakes Qilin as #1 ransomware

Patches

  • Fortinet PSIRT advisory for CVE-2024-55591
  • Erlang/OTP patched releases for CVE-2025-32433
  • Microsoft patches for CVE-2025-33073 (Windows SMB Client) and CVE-2025-32463/CVE-2024-37085 (privilege escalation)

Immediate actions

  • Patch FortiOS/FortiProxy to fixed builds (>7.0.16 / >7.0.19 / >7.2.12) against CVE-2024-55591 and disable public exposure of the management/administrative interface
  • Patch Erlang/OTP to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20+ against CVE-2025-32433
  • Enforce driver allow-listing / Microsoft Vulnerable Driver Blocklist (HVCI, WDAC) to block loading of eb.sys, nseckrnl.sys, GameDriverX64.sys, stpm_old.sys, stpm_new.sys, dmx.sys, 360netmon_wfp.sys, ThrottleBlood.sys, viragt64.sys, and unsigned/BYOVD kernel drivers generally
  • Enforce MFA and rotate credentials on all FortiGate VPN and edge-device accounts; audit for unexpected super_admin accounts and unauthorized domain accounts (e.g. names mimicking 'MicrosoftSupport')
  • Block outbound connections to 194.87.31[.]69:2222 and monitor for Chisel/SystemBC tunneling patterns over 443 and non-standard ports

Workarounds

  • Disable FortiOS/FortiProxy administrative WebSocket access if patching cannot be immediately performed
  • Restrict SSH daemon exposure for Erlang/OTP services to trusted networks only

Longer-term hardening

  • Deploy EDR/XDR with kernel-level tamper-protection and driver-load telemetry that survives Ring-0 process-kill attempts
  • Segment and monitor RMM tool usage (AnyDesk, MeshCentral) with allow-listing and credential rotation policies
  • Implement immutable/offline backups for VMware/ESXi and Veeam environments given the group's virtualization-focused encryptor variants
  • Hunt for Rclone/rclone.ps1 renamed binaries and scheduled-task-based mass exfiltration patterns

CVEs associated with The Gentlemen RaaS overtakes Qilin as #1 ransomware

CVE-2024-55591, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, CVE-2025-32463, CVE-2024-37085, CVE-2025-26125

Weaknesses (CWE) in The Gentlemen RaaS overtakes Qilin as #1 ransomware

CWE-287, CWE-306, CWE-269, CWE-693, CWE-732

Timeline of The Gentlemen RaaS overtakes Qilin as #1 ransomware

  • First Windows ransomware sample uploaded to VirusTotal, marking the earliest observed Gentlemen encryptor build.
  • hastalamuerte, formerly a Qilin affiliate running the ~20-member ArmCorp crew, files a public $48,000 arbitration dispute against Qilin operators on the RAMP forum, precipitating the split into an independent RaaS brand.
  • The Gentlemen officially launches as an independent RaaS with a leak site and a 90% affiliate profit-share model.
  • ESXi-specific locker variant released, capable of killing non-whitelisted processes, deleting VM snapshots, and disabling hypervisor auto-start services.
  • Encryptor updated with a delayed-execution timer (--T flag) and WMI-based domain-wide propagation.
  • PRODAFT publicly ties Gentlemen operators to prior affiliate work with Qilin, Embargo, LockBit, Medusa, and BlackLock.
  • Cybereason analysis identifies a hardcoded RAMP forum post string in a Gentlemen encryptor sample, confirming attribution to hastalamuerte.
  • Rival ransomware actor Devman publicly raises OpSec concerns about The Gentlemen's operational security, documented in underground forum conflict.
  • Group-IB publishes a detailed TTP analysis of hastalamuerte/The Gentlemen, documenting FortiGate exploitation infrastructure, tooling, and IOCs.
  • Alleged insider/BreachForums-linked leak exposes Russian-speaking affiliate handles and administrative details of The Gentlemen operation.
  • ESET publishes 'Killing Me Gently', detailing the GentleKiller EDR-killer framework's eight BYOVD variants and 400+ targeted security processes across 48 vendors.
  • The Gentlemen claims 121 victims in June 2026, overtaking Qilin (80 victims) to become the #1-ranked ransomware operation, ending Qilin's 12-month reign at the top.
  • Unit 42 publishes 'No Manners Here', reporting 580 cumulative claimed victims across 77 countries and additional initial-access CVEs (CVE-2025-32433, CVE-2025-33073, CVE-2025-55182).
  • Bitdefender's July 2026 Threat Debrief formally documents The Gentlemen's rise to #1 RaaS operation, its 90% affiliate model, and LLM-assisted infrastructure maintenance.

Sources cited for The Gentlemen RaaS overtakes Qilin as #1 ransomware

Threats related to The Gentlemen RaaS overtakes Qilin as #1 ransomware

Detection coverage for TL-2026-1332

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1332 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1332

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats