Unmasked: 16GB “Rocket” Database Leak Exposes The Gentlemen Ransomware Cartel

### Executive summary A 16 GB leak of The Gentlemen RaaS backend ("Rocket") exposed operator chats, server logs, and transaction histories revealing a tightly coordinated ransomware cartel responsible for 330+ published victims in five months; the disclosure details initial access vectors (Fortinet/Cisco edge appliances), exploited CVEs (including CVE-2024-55591, CVE-2025-32433, CVE-2025-33073), NTLM relay/reflection tactics, custom evasion tools, AI-assisted development, and aggressive extortion workflows that materially raise the threat to internet-facing services and enterprise environments.