Why Australian and New Zealand Businesses Should Be Worried About The Gentlemen Ransomware
The Gentlemen ransomware group is rapidly becoming a threat that Australian and New Zealand organisations should be paying much closer attention to.
The group, also tracked as Storm-2697 (but not to be confused with the storm ransomware group), has evolved from a relatively new ransomware operation into one of the most prolific Ransomware-as-a-Service (RaaS) operations observed during 2026. Public reporting indicates hundreds of organisations have already been claimed, across more than 50 countries and more than 20 industries.
What makes The Gentlemen particularly concerning is not simply the number of victims.
It is how the group gets access.
The Gentlemen has demonstrated a strong focus on internet-facing infrastructure, compromised credentials and VPN access, while reportedly maintaining a substantial inventory of already-compromised FortiGate devices. This potentially gives affiliates a pool of pre-positioned access that can be exploited when a suitable victim is identified.
For organisations in Australia and New Zealand, that combination of internet exposure, known vulnerabilities, compromised credentials and highly scalable ransomware operations should be a significant warning.
New Zealand businesses victim to The Gentlemen this year include Worralls and Intracare as well as 10 other Australian organisations.
A ransomware operation built for scale
The Gentlemen has been active since at least mid-2025 and is believed to have links to the Qilin ransomware ecosystem.
Its business model is particularly attractive to affiliates.
The group has reportedly offered affiliates up to 90% of ransom proceeds, considerably higher than the commonly reported 70–80% range associated with many RaaS operations. That provides a strong financial incentive for experienced cybercriminals and initial-access brokers to work with the operation.
The results have been dramatic.
One analysis reports approximately 72 victims during 2025, compared with more than 450 confirmed victims during 2026 at the time of its assessment. Other research tracking the group’s leak site counted hundreds more claims as the year progressed.
This is not an operation that appears to be struggling to find victims.
It is scaling.
Australia is already in the group’s sights
The Gentlemen is a global operation, with victims across North America, Europe, Asia and other regions.
Importantly for organisations in this part of the world, Australia has already appeared among the group’s victims.
This does not mean that Australia or New Zealand is a top geographic target for the group.
It does mean there is already evidence that the operation is active in the region.
For New Zealand organisations, this is particularly relevant because many of the characteristics that make Australian organisations attractive targets also apply locally:
- Large numbers of internet-facing services.
- Extensive use of VPN and remote-access technologies.
- Large uptake in FortiGate devices.
- Microsoft Active Directory environments.
- Heavy reliance on third-party technology providers.
- Manufacturing and agricultural industries.
- Healthcare and critical services.
- Smaller security teams managing increasingly complex environments.
The FortiGate problem
Perhaps the biggest reason for Australasian organisations to take The Gentlemen seriously is its reported interest in Fortinet infrastructure.
Research has identified approximately 14,700 compromised FortiGate devices reportedly under the group’s control, alongside nearly 1,000 brute-forced FortiGate VPN credentials.
That is potentially a significant advantage for an attacker.
Instead of discovering, exploiting and establishing access to a new organisation every time, an attacker may already have access to a compromised device and simply need to determine whether the organisation behind that access is worth attacking.
This creates an uncomfortable question for organisations that have patched vulnerable Fortinet equipment:
Was the device compromised before it was patched?
Patching closes a vulnerability. It does not necessarily remove an attacker who has already obtained access.
Organisations operating Fortinet firewalls, VPNs or other edge infrastructure should therefore consider historical compromise as well as current vulnerability status.
The vulnerabilities organisations need to know about
The Gentlemen has been associated with exploitation of several vulnerabilities affecting internet-facing infrastructure and enterprise systems.
The most prominent is CVE-2024-55591, affecting Fortinet FortiOS and FortiProxy. Other vulnerabilities linked to the group’s activity include vulnerabilities affecting Erlang/OTP, Windows SMB, React Server Components and a Windows driver.
CVEs associated with The Gentlemen
| CVE | Affected technology | Reported relevance |
|---|---|---|
| CVE-2024-55591 | Fortinet FortiOS / FortiProxy | Reported as a primary initial-access vector; particularly important for internet-facing Fortinet infrastructure |
| CVE-2025-32433 | Erlang/OTP SSH Server | Exploited for initial access; associated reporting links the vulnerability to network appliances |
| CVE-2025-33073 | Microsoft Windows SMB Client | Associated with NTLM relay activity and post-compromise credential access |
| CVE-2025-55182 | React Server Components / React2Shell | High-severity vulnerability associated with the group’s exploitation activity |
| CVE-2025-7771 | ThrottleStop.sys driver | Associated with privilege escalation / defence evasion activity |
The lesson for Australian and New Zealand businesses is straightforward:
These are not necessarily vulnerabilities that can be treated as historical patching exercises.
If an internet-facing device was vulnerable during a period of active exploitation, organisations should consider whether it was actually compromised rather than simply confirming that it is now patched.
The group does not need a single way in
Another reason The Gentlemen is concerning is that it does not appear dependent on one initial-access mechanism, but include:
- Compromised credentials
- Exploitation of public-facing applications
- Phishing
- RDP access
- VPN access abuse
as known infection vectors.
This creates a much broader defensive challenge.
An organisation may have excellent email security and still be exposed through its VPN.
It may have patched its VPN but have compromised credentials circulating in criminal marketplaces.
It may have strong endpoint security but an internet-facing appliance that was compromised months earlier.
The Gentlemen’s operational model means defenders need to think about attack paths rather than individual controls.
MITRE ATT&CK Techniques
| ATT&CK ID | Technique | How it relates to The Gentlemen |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Exploitation of internet-facing infrastructure, including Fortinet devices |
| T1078 | Valid Accounts | Use of compromised or stolen credentials for access |
| T1110 | Brute Force | Brute-forcing credentials, including VPN credentials |
| T1133 | External Remote Services | Abuse of VPN, RDP and other remote-access services |
| T1046 | Network Service Scanning | Network discovery and identification of accessible systems and services |
| T1087 | Account Discovery | Enumeration of accounts within compromised environments |
| T1082 | System Information Discovery | Discovery of operating-system and system information |
| T1482 | Domain Trust Discovery | Mapping Active Directory trust relationships |
| T1021 | Remote Services | Lateral movement through remote services |
| T1059.001 | PowerShell | Command execution and security-control manipulation |
| T1555 | Credentials from Password Stores | Credential-access activity |
| T1562.001 | Impair Defenses | Attempts to disable or bypass security controls and EDR |
| T1484 | Domain Policy Modification | Modification of domain policy to facilitate broader compromise |
| T1005 | Data from Local System | Collection of data from compromised systems |
| T1039 | Data from Network Shared Drive | Collection from network shares |
| T1213 | Data from Information Repositories | Collection of organisational information |
| T1567 | Exfiltration Over Web Service | Exfiltration of stolen information |
| T1490 | Inhibit System Recovery | Actions intended to prevent or complicate recovery |
| T1486 | Data Encrypted for Impact | Deployment of ransomware to encrypt victim data |
| T1657 | Financial Theft / Extortion | Extortion and financial pressure following compromise |
The precise techniques observed will vary between intrusions because The Gentlemen operates an affiliate model, but the overall sequence is familiar: gain access, establish control, understand the environment, obtain privileged access, steal data, disable defences and then deploy ransomware.
The tools defenders should be watching for
The Gentlemen’s use of legitimate administration and security tools is another challenge.
Many of the tools associated with the group are not inherently malicious. PowerShell, PsExec, WMI, AnyDesk and WinSCP can all have legitimate uses inside an organisation.
The concern is the context in which they are used.
Known tools associated with The Gentlemen
| Tool | Typical legitimate purpose | Why defenders should care |
|---|---|---|
| AnyDesk | Remote desktop / support | Can provide persistent remote access |
| Advanced IP Scanner | Network discovery | Can assist attackers with network reconnaissance |
| ICACLS | Windows permissions management | Can be used to manipulate file and directory permissions |
| Nmap | Network discovery and scanning | Useful for mapping internal infrastructure |
| PowerRun | Execute processes with elevated privileges | Can facilitate privileged execution |
| PowerShell | Windows administration and automation | Frequently abused for execution and defence evasion |
| PsExec | Remote administration / process execution | Can enable rapid lateral movement and ransomware deployment |
| PuTTY | SSH / remote administration | Can provide remote access to systems |
| WMI | Windows management | Can be abused for remote execution and administration |
| WinSCP | Secure file transfer | Associated with encrypted data exfiltration |
The important point is that security teams should not simply block these applications (but if you can block them, then do so!).
In many organisations, doing so would break legitimate business processes.
Instead, the question should be:
Why is this user running PsExec? Why is AnyDesk appearing on this server? Why is PowerShell suddenly executing against hundreds of machines? Why is WinSCP transferring large quantities of data from a sensitive server?
The EDR problem
The Gentlemen has demonstrated a particular interest in defeating endpoint security.
Reporting describes attempts to disable or bypass EDR products before ransomware deployment, including the use of driver-based techniques. The group has also been associated with an EDR-killer framework known as GentleKiller.
This is significant because traditional ransomware detection often assumes the endpoint security agent will still be operating when encryption begins.
If the attacker can neutralise the EDR first, that assumption disappears.
Security teams should therefore monitor for the attempt to disable security controls, not simply the ransomware executable that follows.
A SOC should have detections for:
- Attempts to stop security services.
- Unexpected driver installation.
- Security-agent exclusions being created.
- Registry modifications affecting security products.
- Privileged PowerShell activity.
- Unexpected administrative tools appearing on endpoints.
- Sudden loss of endpoint telemetry.
- Multiple endpoints losing EDR visibility simultaneously.
The disappearance of security telemetry can itself be a security event.
Why New Zealand should care
There is currently no basis to claim that New Zealand is a primary target of The Gentlemen.
New Zealand organisations also operate many of the same technologies and business models targeted elsewhere by the group.
The threat therefore does not require The Gentlemen to make a deliberate decision to “target New Zealand”.
If the group is scanning internet-facing infrastructure, purchasing compromised credentials, exploiting vulnerable edge devices and working with affiliates, New Zealand organisations can become targets simply because they present an exploitable or valuable opportunity.
Based on the above and with the speed The Gentlemen are accumulating victims it is inevitable more New Zealand And Australian businesses will fall prey.
The real risk is the combination
Individually, none of the characteristics of The Gentlemen are particularly unusual.
Ransomware groups exploit vulnerabilities.
They steal credentials.
They use legitimate administration tools.
They disable security products.
They steal data.
They encrypt systems.
What makes The Gentlemen concerning is the combination and scale.
The group reportedly has:
A large pool of pre-compromised infrastructure + multiple initial-access methods + an attractive affiliate model + mature attack tooling + defence-evasion capabilities + double extortion + rapidly increasing victim numbers.
That is a powerful combination.
For Australian and New Zealand organisations, the biggest warning sign may therefore be the group’s reported stockpile of compromised FortiGate devices.
If an organisation uses Fortinet infrastructure, the question should not simply be:
“Are we patched?”
It should be:
“Can we demonstrate that our internet-facing infrastructure has not already been compromised?”
What should organisations do now?
Organisations in Australia and New Zealand should consider The Gentlemen when reviewing their ransomware readiness.
At a minimum:
1. Review internet-facing infrastructure
Identify every internet-facing firewall, VPN, remote-access gateway and application.
Determine whether any were exposed to known exploited vulnerabilities and whether compromise could have occurred before remediation.
Are the devices hardened? In that are unnecessary ports disabled or locked down? Are you monitoring in case someone accidentally opens up a port. Don’t forget to lock down protocols such as RIP, IPSEC, BGP, ICMP as UDP services are actively scanned alongside TCP.
2. Investigate Fortinet exposure
For organisations using Fortinet infrastructure, investigate historical exposure to CVE-2024-55591 and other relevant vulnerabilities.
Do not assume that patching alone proves the absence of compromise.
3. Hunt for compromised credentials
Review privileged, VPN, RDP and remote-access accounts for unusual activity.
MFA should be enforced wherever technically possible, particularly for administrative and remote-access accounts.
4. Watch the legitimate tools
Build detections around unusual use of:
PsExec, PowerShell, WMI, AnyDesk, WinSCP, Nmap and other administrative utilities.
You may not be able to cover all of them with detections due to false positives but cover the ones you can.
5. Monitor for EDR interference
Treat attempts to stop, modify or bypass endpoint security controls as high-priority events.
6. Test ransomware recovery
Backups are only useful if they can actually be restored.
Maintain offline or immutable backups and regularly test recovery of critical systems.
The Bottom Line
The Gentlemen should be on the threat radar of Australian and New Zealand organisations.
It is not simply another ransomware group waiting for an employee to click a malicious attachment.
It has demonstrated an ability to exploit internet-facing infrastructure, abuse compromised credentials, leverage remote-access technologies, move through enterprise networks, steal information and attempt to neutralise security controls before deploying ransomware.
Its rapid growth is equally concerning.
A ransomware operation that can combine a large access inventory with a financially attractive affiliate model can potentially scale attacks far faster than a conventional criminal group operating from scratch.
For organisations in Australia and New Zealand, the immediate priority should be understanding exposure rather than waiting for a victim listing.
Check the edge.
Check the credentials.
Check the VPN.
Check Active Directory.
Check the endpoints.
And, perhaps most importantly, check whether your security monitoring would still work if an attacker was actively trying to turn it off.
Current assessment
Threat level for New Zealand organisations: HIGH
Threat level for Australian organisations: HIGH
The assessment reflects The Gentlemen’s demonstrated activity in Oceania, rapidly increasing victim numbers, broad sector targeting, exploitation of internet-facing infrastructure and ability to operate at scale.
This should not be interpreted as evidence that every Australian or New Zealand organisation is being specifically targeted by the group. Rather, the group’s capabilities and existing regional activity make it a threat that should be incorporated into ransomware threat modelling and defensive monitoring.
