thegentlemen Ransomware Group

Key insights

• •Targets primarily sectors like healthcare, technology, and construction, avoiding Commonwealth of Independent States entities.
• •Initial access often gained through exploitation of CVE-2024-55591 in FortiOS and FortiProxy devices.
• •Employs advanced tactics including BYOVD attacks for evasion and a pre-ransomware script to disable security measures.
• •Maintains a database of compromised credentials to enhance targeting and operational effectiveness.
• •Demonstrates a preference for rapid data publication to maximize pressure on victims.