# The Gentlemen RaaS (GOLD SHERWOOD / hastalamuerte): FortiGate/VPN Intrusion Chain, GentleKiller BYOVD EDR Killers, and Rclone Exfiltration

> The Gentlemen ransomware-as-a-service operation (Sophos CTU tracking name GOLD SHERWOOD; operator handle hastalamuerte) breaches victims through compromised Fortinet SSL VPN credentials and exploitation of the FortiOS/FortiProxy authentication-bypass flaw CVE-2024-55591, then moves laterally over RDP with valid domain credentials, deploys the in-house GentleKiller BYOVD EDR-killer framework, and exfiltrates data via Rclone before detonating Go-based locker binaries. Leak-site postings rose from under 20/month in late 2025 to 169 in July 2026 alone (683 victims total), with a median attacker dwell time near two days.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-10-12T03:27:04.804Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2271
- **ID:** TL-2026-2271
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen RaaS operators
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-32433

## Description

The Gentlemen is a Russian-speaking ransomware-as-a-service operation that emerged publicly in July-September 2025, run by an operator known as hastalamuerte (alias Zeta88), who previously operated under the handle ArmCorp as a Qilin affiliate before launching an independent RaaS brand offering a 90/10 affiliate revenue split -- among the most generous in the criminal ecosystem. Sophos CTU (incorporating former Secureworks CTU research and tracking the group as GOLD SHERWOOD) documents the group's primary initial-access chain as a combination of brute-forced and stolen/leaked Fortinet SSL VPN credentials plus active exploitation of CVE-2024-55591, a critical (CVSS 9.8) authentication bypass in the FortiOS/FortiProxy Node.js WebSocket module that lets an unauthenticated remote attacker obtain super-admin privileges on internet-exposed firewall management interfaces via a four-step flaw chain: unauthenticated WebSocket session creation, abuse of the local_access_token parameter, a race-condition window, and bypass of subsequent credential validation. Group-IB's TTP analysis, corroborated by an internal May 2026 data leak (leaked Rocket.Chat operator logs and an operator database), found the group maintains a working inventory of roughly 14,700 internet-exposed FortiGate devices and 969 validated brute-forced VPN credential pairs, and selects targets based on FortiGate misconfiguration, LDAP integration, and ransom-payment likelihood rather than geography or sector.

Once inside, operators pivot rapidly -- median dwell time to ransomware deployment is roughly two days, with some incidents under 24 hours. Lateral movement is conducted primarily over RDP using valid domain credentials against file servers and domain controllers, supported by discovery tooling (Advanced IP Scanner, SoftPerfect Network Scanner, NetExec) and credential access via Mimikatz-based LSASS dumping and a custom Python harvester (userpassfort.py). Persistence and defense-evasion techniques include creating rogue domain admin accounts via native `net` commands, enabling RDP through registry and firewall changes, disabling Windows Defender via PowerShell (`Add-MpPreference -ExclusionPath C:\ -Force`), stopping backup services (VeeamBackupSvc, SQLWriter, BackupExecAgent, and 200+ other service-name variants), clearing Windows Application/System/Security event logs, and staging attacker tooling under the benign-looking `C:\PerfLogs\` directory.

The operation's signature capability, documented in depth by ESET's June 2026 'Killing Me Gently' research, is GentleKiller: a centralized, operator-maintained Bring-Your-Own-Vulnerable-Driver (BYOVD) EDR-killer framework with at least eight distinct variants, each impersonating a legitimate security or gaming product (Kaspersky, FACEIT Anti-Cheat, Valorant, EA/Javelin Anti-Cheat, WatchDog, a network blocker, a file-deletion 'Cleaner', and a Symantec/G11 variant) and each abusing a different vulnerable kernel driver (eb.sys, nseckrnl.sys, GameDriverX64.sys, stpm_old/new.sys, dmx.sys, 360netmon_wfp.sys, IObit's force-delete filter driver, and a PoisonX rootkit driver) to terminate endpoint protection at the kernel level. Rather than leaving driver-sourcing to affiliates, Gentlemen operators actively maintain the portfolio and fold in third-party/leaked killers (HexKiller, ThrottleBlood, HavocKiller), adopting newly disclosed BYOVD proofs-of-concept within days of public release -- consistently outpacing Microsoft's Vulnerable Driver Blocklist update cycle. Collectively the suite targets more than 400 processes across 48 named security products (Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Kaspersky, Bitdefender, Trellix/McAfee, ESET, Palo Alto Networks, Trend Micro, Carbon Black, Cybereason, Huntress, and others). A domain-wide deployment script (`\\NETLOGON\avkill.bat`) pushes the killer suite to hosts network-wide.

Data exfiltration is dominated by Rclone (renamed to evade detection, e.g. avastrclone.exe), used with filtered, multi-threaded copy jobs (`--transfers 8 --max-age`, `--include-from`/`--filter-from`) staged to attacker-controlled Wasabi object-storage buckets named after the victim; Restic, MinIO Client, MEGAsync, and FileZilla are used as secondary channels, and remote-access tooling (Cloudflared, AnyDesk, MeshCentral, Datto RMM, Chisel) supports persistence and tunneling. The final-stage locker is a Go-based binary (`locker_<ext>_windows_amd64.exe` / `G_<ext>_windows_amd64.exe`), distributed with dedicated Windows, Linux/ESXi, and NAS encryptors, incorporating reverse-engineered encryption routines drawn from Babuk, Qilin, LockBit 5.0, and Medusa, appending a six-character extension to encrypted files, requiring a password/key argument to execute, and dropping a `README-GENTLEMEN.txt` ransom note; a September 2025 update added aggressive WMI-based self-propagation across a compromised network. By end of July 2026, Sophos CTU counted 683 total leak-site victims, up from fewer than 20/month in late 2025 to 169 in July 2026 alone, spanning manufacturing (the most-targeted single sector per Trend Micro, 103 of 580 tracked victims through early July), healthcare, finance, retail, and critical-infrastructure organizations across at least 17 regions/77 countries.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078.002 Valid Accounts: Domain Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1136.002 Create Account: Domain Account
- T1003.001 OS Credential Dumping: LSASS Memory
- T1110.001 Brute Force: Password Guessing
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1036.001 Masquerading: Invalid Code Signature
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1569.002 System Services: Service Execution
- T1572 Protocol Tunneling
- T1098 Account Manipulation
- T1112 Modify Registry
- T1074.001 Data Staged: Local Data Staging
- T1486 Data Encrypted for Impact
- T1489 Service Stop

## Sources

- [Ungentlemanly behavior: Insights into a ransomware operation](https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation)
- [FortiOS & FortiProxy: Authentication Bypass in Node.js Websocket Module](https://www.fortra.com/security/emerging-threats/fortios-fortiproxy-authentication-bypass-nodejs-websocket-module)
- [CVE-2024-55591 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-55591)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [How Hastalamuerte Operates: Group-IB's Analysis of The Gentlemen's RaaS TTPs](https://www.group-ib.com/blog/hastalamuerte-gentlemen-raas-ttps/)
- [Killing me gently: Inside Gentlemen's EDR killer framework](https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/)
- [No Manners Here: The Ruthless Rise of The Gentlemen Ransomware](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)
- [Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures](https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2271