The Gentlemen RaaS Targets Fortinet and Cisco Edge Devices for Initial Access
3 min. read 
Published on
The Gentlemen ransomware group is using exposed edge devices, stolen credentials, and known vulnerability paths to break into corporate networks before deploying ransomware.
<a href="http://
- Patch Fortinet, Cisco, Windows, VPN, firewall, and remote access systems quickly.
- Remove public exposure from management interfaces wherever possible.
- Enforce MFA on VPN, OWA, Microsoft 365, and admin portals.
- Audit FortiGate and Cisco edge devices for suspicious logins and configuration changes.
- Disable or restrict legacy NTLM where possible.
- Enable SMB signing on critical Windows systems.
- Review Active Directory for unconstrained delegation and risky privilege paths.
- Harden EDR against tampering and alert on service changes.
- Monitor for Cloudflare tunnels or unexpected outbound tunneling tools.
- Keep tested offline backups separated from domain credentials.
Detection ideas for security teams
Detection should focus on behavior, not only indicators. A ransomware group that runs an affiliate model can change tooling from one intrusion to another.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
Teams should monitor failed and successful VPN logins, new admin sessions, unusual geolocation patterns, and configuration changes on edge devices. They should also review sudden changes to EDR services, registry settings, backup systems, and virtualization hosts.
Network telemetry should flag unexpected tunnels, unusual outbound connections, and large archive uploads from file servers or administrator workstations.
- Repeated login attempts against VPN and firewall panels.
- New administrator accounts on edge devices.
- Configuration exports from Fortinet or Cisco appliances.
- RelayKing, ntlmrelayx, or other NTLM relay tooling activity.
- Suspicious use of Cloudflare tunnels or reverse proxies.
- EDR service stops, driver abuse, or security tool tampering.
- Large data transfers before encryption events.
- Linux and ESXi activity tied to ransomware staging.
The larger lesson from the Rocket leak
The Rocket leak gives defenders a rare look at how a modern ransomware service operates behind the scenes. It shows a group that blends criminal recruiting, affiliate management, vulnerability tracking, access brokers, and structured negotiation tactics.
The Gentlemen’s speed also shows why exposed edge devices remain a top ransomware risk. Once attackers control perimeter access, they can move from one appliance to a full-domain incident quickly.
For most organizations, the most effective response is clear: harden the edge, reduce credential exposure, close NTLM relay paths, monitor tunnels, and make sure ransomware recovery plans work before attackers test them.
FAQ
The Gentlemen is a ransomware-as-a-service operation that emerged around mid-2025. It recruits affiliates, provides ransomware tooling, and shares ransom payments with participants.
The group focuses on exposed edge systems such as VPN appliances, firewalls, OWA, Microsoft 365 access paths, and Fortinet or Cisco-related environments. It also uses brute force, leaked credentials, access brokers, and known vulnerability paths.
Check Point says leaked chats show the group tracking and evaluating CVE-2024-55591, CVE-2025-32433, and CVE-2025-33073. Researchers could not confirm that every targeted system was vulnerable to those exact flaws.
Fortinet and Cisco devices often sit at the network perimeter. If attackers compromise these systems, they may gain a trusted route into internal networks and begin reconnaissance, privilege escalation, and ransomware staging.
Organizations should patch edge devices, restrict management interfaces, enforce MFA, audit VPN and firewall logs, reduce NTLM exposure, enable SMB signing, monitor tunneling tools, harden EDR, and maintain tested offline backups.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages