Ransomware Group Targets Fortinet and Cisco Devices To Breach Networks

**The Gentlemen RaaS** has rapidly expanded since mid-2025 into a high-volume ransomware operation, publishing hundreds of victims and with research revealing over a thousand compromised corporate environments and tens of thousands of abused edge devices (notably FortiGate). Leaked internal chats and an exposed database detail an affiliate-driven profit model, double-extortion extortion, credential brute-forcing and exploitation of public-facing vulnerabilities, and a mature toolset (NetExec, SystemBC, Velociraptor, DumpBrowserSecrets) used to exfiltrate data and deploy multi-OS lockers across critical sectors including healthcare, energy, and manufacturing.