Reported by 1 outlet
The Gentlemen ransomware — leaked internal database reveals 14,700 compromised FortiGate devices, 1,570+ corporate environments
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
The Gentlemen ransomware — leaked internal database reveals 14,700 compromised FortiGate devices, 1,570+ corporate environments
cyberpress.org · 153d ago · May 14th, 2026
The May 12 digest documented The Gentlemen's rapid rise to second-most-active ransomware group globally. New intelligence from a leaked internal database exposed on underground forums now reveals the scale of their edge-device-focused initial access strategy: the group maintains an inventory of approximately 14,700 compromised Fortinet FortiGate VPN appliances exploited via known vulnerabilities, alongside hundreds of brute-forced credentials. A C2 server leak exposed over 1,570 compromised corporate environments — vastly more than the 330+ victims publicly listed. Affiliates systematically scan for exposed Fortinet and Cisco edge devices, leverage NetExec for AD discovery, SystemBC and Velociraptor for covert remote access, and use customized DumpBrowserSecrets tools for session hijacking. The group offers affiliates 90% of ransom payments — an unusually aggressive split that is luring experienced operators from competing cartels. The leaked communications also reveal intent to abuse legitimate code-signing certificates. Organizations running Fortinet or Cisco edge infrastructure should verify patch status immediately and hunt for NTLM relay and credential brute-force activity.