The Gentlemen RaaS Exploits Fortinet and Cisco Devices for Network Breaches
The Gentlemen, a ransomware-as-a-service (RaaS) group, has rapidly become a significant player in the cyber threat landscape since its emergence in mid-2025. The group operates through an affiliate model, offering a lucrative 90% share of ransom payments to its partners, which has attracted numerous participants. Recently, a leak of the group's internal database provided insights into their operations, revealing their focus on exploiting vulnerabilities in Fortinet and Cisco edge devices to gain initial network access. The group uses a combination of brute-force attacks, known vulnerabilities, and purchased access to infiltrate networks. Once inside, they conduct reconnaissance, escalate privileges, and deploy ransomware, often using exfiltrated data as leverage in ransom negotiations. 
