THEGENTLEMEN Ransomware: 15 New Victims — Global Manufacturing Surge & Critical CVE Exploitation

Date: 2026-06-18
Source: Ransomware.live .onion Telemetry
Analyst: Security Arsenal Intel Unit

Threat Actor Profile — THEGENTLEMEN

THEGENTLEMEN is a sophisticated Ransomware-as-a-Service (RaaS) operation that distinguishes itself through a "professional" extortion persona. Unlike chaotic gangs, they typically communicate via formal channels and maintain a polished leak site.

• Operational Model: RaaS with affiliate network. Affiliates handle initial access and encryption, while core team manages leak site negotiation and data publication.
• Ransom Demands: High, typically ranging from $2M to $10M USD, scaling strictly with victim revenue.
• Initial Access: Historically relies heavily on External Remote Services exploitation. Recent intelligence confirms a pivot toward exploiting management interfaces (ConnectWise, Cisco FMC) and VPN vulnerabilities (Check Point).
• Extortion Strategy: Aggressive double extortion. Victims' data is posted to the leak site exactly 7 days post-encryption if negotiations fail.
• Dwell Time: Short and violent. Average dwell time observed in this campaign is 3–5 days from initial access to encryption, suggesting automated tooling for lateral movement.

Current Campaign Analysis

Victim Overview

On 2026-06-15, THEGENTLEMEN posted a batch of 15 new victims, indicating a significant acceleration in operations (average of ~5 postings per day).

Sector Targeting

The campaign aggressively targets critical operational technology and data-rich sectors:

• Manufacturing (33%): Buechel Stone, Cole Manufacturing, Traublinger, Buratti. This group appears intent on disrupting production lines to maximize pressure.
• Technology (13%): Times Software, SigmaControl.
• Agriculture/Food (13%): Fecovita, Mackay Sugar.
• Energy & Public Sector: Maine Oxy (Energy), National Museum (Public Sector).

Geographic Distribution

• Americas: US (4), AR (1), CA (1)
• Europe: PL (1), FR (1), DE (2), IT (1), NL (1), DK (1)
• Asia-Pacific: SG (1), AU (1)

CVE Exploitation & Initial Access Vectors

Based on the CISA KEV list correlated with victim sectors (Tech/Mfg utilizing VPNs/Remote Management), we assess with high confidence that affiliates are actively exploiting:

1. CVE-2024-1708 (ConnectWise ScreenConnect): High usage in the Technology and Business Services victims to gain RMM access.
2. CVE-2026-50751 (Check Point Security Gateway): Likely used for initial entry into the manufacturing and energy sectors where VPNs are prevalent.
3. CVE-2026-20131 (Cisco Secure Firewall FMC): Exploitation allows disabling of security controls and pivoting into the internal network.

Detection Engineering

Sigma Rules

---
title: Potential ConnectWise ScreenConnect Authentication Bypass
id: 3b8a7c9d-1e4f-4a2b-8g5h-9i0j1k2l3m4n
description: Detects potential exploitation of CVE-2024-1708 involving suspicious path traversal or authentication anomalies in ScreenConnect logs.
status: experimental
author: Security Arsenal
date: 2026/06/18
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: web
    product: connectwise_screenconnect
detection:
    selection:
        c-uri|contains:
            - '/Bin/'
            - 'App_Extensions'
        cs-method|contains: 'POST'
    condition: selection
falsepositives:
    - Legitimate administrative plugin installation
level: critical
---
title: Check Point VPN IKEv1 Exploitation Attempt
id: a1b2c3d4-e5f6-7890-g1h2-i3j4-k5l6m7n8o9p0
description: Detects indicators of CVE-2026-50751 exploitation related to IKEv1 improper authentication and key exchange anomalies.
status: experimental
author: Security Arsenal
date: 2026/06/18
logsource:
    category: network
    product: zeek
    service: vpndetection:
    selection:
        ike.version: '1'
        ike.notification|contains: 'INVALID-PAYLOAD'
    condition: selection
falsepositives:
    - Misconfigured legacy VPN clients
level: high
---
title: THEGENTLEMEN Lateral Movement Pattern
id: l9m8n7o6-p5q4-r3s2-t1u0-v9w8x7y6z5a
description: Detects typical THEGENTLEMEN lateral movement using PsExec and WMI for payload distribution, often observed post-VPN exploitation.
status: experimental
author: Security Arsenal
date: 2026/06/18
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
        CommandLine|contains: 'accepteula'
    selection_wmi:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'process call create'
    condition: 1 of selection*
falsepositives:
    - System administration tasks
level: high

KQL Hunt Query (Microsoft Sentinel)

// Hunt for lateral movement and potential ransomware staging associated with THEGENTLEMEN
// Focus on processes spawned after VPN or Remote Admin connections
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('psexec.exe', 'psexec64.exe', 'wmic.exe', 'powershell.exe', 'cmd.exe')
| where ProcessCommandLine has_any ('-enc', 'EncodedCommand', 'process call create', 'accepteula')
| where InitiatingProcessFileName has_any ('services.exe', 'svchost.exe', 'explorer.exe', 'chrome.exe', 'msedge.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

Rapid Response Script (PowerShell)

# THEGENTLEMEN Response Audit Script
# Checks for recent scheduled task creation (persistence) and VSS manipulation (staging)

Write-Host "[!] Auditing for THEGENTLEMEN Indicators of Compromise..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in the last 7 days
$suspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and 
    $_.Author -notmatch "Microsoft|Microsoft Corporation|NVIDIA|Intel"
}

if ($suspiciousTasks) {
    Write-Host "[WARNING] Found recently created scheduled tasks (Potential Persistence):" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Author, Date, Actions | Format-Table -AutoSize
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check Volume Shadow Copy Status
$vss = Get-WmiObject -Class Win32_ShadowCopy | Measure-Object
Write-Host "[INFO] Current Volume Shadow Copies found: $($vss.Count)" -ForegroundColor Yellow

# 3. Check for PsExec/WMI Execution Logs (Event ID 4688)
Write-Host "[INFO] Checking Event Logs for PsExec/WMI execution..."
$events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName'] and (Data='psexec.exe' or Data='wmic.exe')]]" -ErrorAction SilentlyContinue -MaxEvents 5
if ($events) { $events | Select-Object TimeCreated, Message } else { Write-Host "[OK] No immediate PsExec/WMI events found." }


---

Incident Response Priorities

T-minus Detection Checklist

• VPN Concentrator Logs: Scrutinize logs for Check Point (CVE-2026-50751) anomalies. Look for successful authentication followed immediately by multiple internal connections.
• RMM / Remote Admin: Audit ConnectWise ScreenConnect logs for the SetupWizard.aspx or anomalous URI patterns indicative of CVE-2024-1708.
• Firewall Management: Check Cisco FMC logs for unauthorized deserialization attempts or sudden configuration changes (CVE-2026-20131).

Critical Assets for Exfiltration

THEGENTLEMEN prioritizes:

1. CAD/PLM Designs: Intellectual property in Manufacturing victims (Buechel, Cole).
2. Employee PII/HR Data: Exfiltrated from Education and Public Sector victims (Kozminski, National Museum).
3. Financials: Payment records and client databases from Business Services.

Containment Actions

1. Isolate: Immediately disconnect VPN concentrators and Cisco FMC appliances from the management network if compromise is suspected.
2. Suspend: Disable all privileged service accounts used for remote management (e.g., svc_screenconnect, vpn_admin).
3. Block: Block inbound/outbound traffic to known Cobalt Strike C2 infrastructure on the edge firewalls.

Hardening Recommendations

Immediate (24 Hours)

• Patch CVE-2024-1708: Apply the ScreenConnect hotfix immediately to all internet-facing instances.
• Patch CVE-2026-50751: Update Check Point Security Gateways to the latest firmware that addresses the IKEv1 authentication bypass.
• MFA Enforcement: Enforce phishing-resistant MFA on all VPN and Remote Desktop access points.

Short-term (2 Weeks)

• Network Segmentation: Isolate management planes (Cisco FMC, ScreenConnect servers) from the general production network.
• Audit VPN Accounts: Review all VPN user accounts. Remove dormant accounts and enforce "just-in-time" access for administrators.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub