Gentlemen ransomware group uses Fortinet exploits

Check Point Research said on May 13 that leaked internal chats from The Gentlemen ransomware operation showed affiliates discussing initial access through Fortinet and Cisco edge appliances, NTLM relay, and OWA or Microsoft 365 credential logs. The researchers said the leak gave an end-to-end view of the group’s infrastructure, affiliates and victim handling after an internal backend database was exposed on May 4. FortiGuard Labs separately lists The Gentlemen as an emerging ransomware group that appeared in mid-2025 and says the actor is associated with several CVEs, including Fortinet flaws CVE-2024-55591 and CVE-2025-55182. FortiGuard says the group’s leak site had listed more than 200 victim organizations in over 50 countries as of early 2026, while Check Point put the group’s public victim count at about 332 in the first five months of 2026. (research.checkpoint.com) ### Which part of the reporting actually ties The Gentlemen to Fortinet exploits? Check Point Research’s May 13 report is the clearest public source tying The Gentlemen to Fortinet access paths. The company said leaked internal discussions detailed “initial access paths” that included Fortinet edge appliances and showed the group actively tracking modern CVEs, including CVE-2024-55591. FortiGuard Labs reinforces that link from the vendor side. (fortiguard.fortinet.com) Its threat-actor entry for The Gentlemen lists CVE-2024-55591 and CVE-2025-55182 under “Common Vulnerabilities and Exposures” associated with the group. Fortinet’s PSIRT advisory for CVE-2024-55591 says the flaw affects FortiOS and FortiProxy and may allow a remote attacker to gain super-admin privileges, adding that it has been exploited in the wild. Fortinet’s outbreak alert for CVE-2025-55182 says CISA added that bug to the Known Exploited Vulnerabilities catalog on Dec. 5, 2025. (research.checkpoint.com) ### What do researchers say about the group’s broader playbook? Check Point said on April 20 that an affiliate associated with The Gentlemen deployed SystemBC, a proxy malware used for covert tunneling and payload delivery, during an incident-response case. The researchers said telemetry from the related command-and-control server showed a botnet of more than 1,570 victims and suggested the infections were concentrated in corporate and organizational environments. (fortiguard.fortinet.com) The same report said The Gentlemen offers lockers for Windows, Linux, NAS, BSD and ESXi systems and gives verified partners access to “EDR-killing tools” and multi-chain pivot infrastructure. Check Point said negotiations are handled through affiliate Tox IDs rather than the public leak portal, and a later report said leaked negotiations showed one case ending in a $190,000 payment after an initial $250,000 demand. (research.checkpoint.com) ### Where does the “AI tools” claim come from? The June 2 and June 3 social-media posts cited in the source briefings describe The Gentlemen as using Fortinet exploits alongside AI tools and custom command-and-control frameworks. Those posts were part of a social-media roundup, not a primary technical disclosure, and the strongest independently verifiable public reporting found in this review is the Check Point and Fortinet material on Fortinet access paths, SystemBC, custom infrastructure and affiliate operations. (research.checkpoint.com) Fortinet’s broader threat-intelligence materials describe its own security platform as AI-enabled, but the sources reviewed here do not provide a primary technical breakdown showing exactly how The Gentlemen used AI in specific intrusions. That makes the AI element less firmly documented than the Fortinet-appliance and SystemBC elements. ### Which Fortinet flaws are most relevant for defenders to check first? Fortinet’s advisory for CVE-2024-55591 says the issue is an authentication bypass in FortiOS and FortiProxy that can let a remote attacker gain super-admin privileges through crafted requests. (research.checkpoint.com) Fortinet’s outbreak alert for CVE-2025-55182 says that flaw was added to CISA’s KEV catalog after confirmed exploitation, making both bugs priority patch items for organizations running affected products. (fortiguard.fortinet.com) CISA’s KEV catalog remains the federal reference point for vulnerabilities known to be exploited in the wild, and Fortinet’s PSIRT portal carries affected-version and remediation details for its products. Organizations reviewing exposure to The Gentlemen’s reported access paths would likely start with those two sources and then compare them against internet-facing FortiGate, FortiProxy and related deployments. ### What happens next in the public record? (fortiguard.fortinet.com) Fortinet’s PSIRT advisories and FortiGuard threat-actor pages are the main vendor sources to watch for updated mitigations, affected-version lists and any added CVE associations for The Gentlemen. Check Point Research’s ransomware reports are the clearest public source so far on the group’s affiliate structure, Fortinet access references and SystemBC-linked infrastructure. (fortiguard.fortinet.com) (cisa.gov)