Gentlemen RaaS and FortiBleed Credential Leak Analysis

The Gentlemen Ransomware-as-a-Service (RaaS) group, founded by threat actor 'hastalamuerte', has emerged as a highly technical operator in 2026. Unlike traditional models where affiliates find their own evasion tools, Gentlemen provides a centrally maintained suite of Endpoint Detection and Response (EDR) killers, primarily the in-house 'GentleKiller' framework. This suite also incorporates third-party tools like HexKiller, ThrottleBlood, and HavocKiller, which are standardized with a shared evasion layer involving packers like Enigma and Themida.

Simultaneously, a massive data exposure named 'FortiBleed' has leaked credentials for over 73,000 Fortinet VPN devices worldwide. Evidence suggests Gentlemen operators select targets based on these FortiGate configurations. Their operations are geographically diverse, focusing on Southeast Asia, South America, and Western Europe, and involve advanced Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security engines across over 48 different security vendors.