The Gentlemen Ransomware Group — Leak Analysis

**Executive Summary:** The leaked Rocket.Chat corpus from The Gentlemen RaaS reveals a professionally organised ransomware operation (emerged Jul–Aug 2025) that exploited Fortinet vulnerabilities (CVE-2024-55591 and others), reused branded VPN credentials, operated custom C2 (G-BOT), repurposed Velociraptor, performed large-scale credential theft/exfiltration (rclone, XenAllPasswordPro), integrated AI for negotiation/triage, and impacted hundreds of victims (66 confirmed in this 6-month window, ~400+ publicly attributed), providing rich TTPs, IOCs (hashes, BTC addresses, .onion endpoints, Tox IDs), and concrete detection/hardening guidance for defenders.