THEGENTLEMEN Ransomware: Critical Surge in Manufacturing & Energy Sectors Leveraging Perimeter Exploits

Threat Actor Profile — THEGENTLEMEN

Aliases & Structure: THEGENTLEMEN are a relatively new but aggressive operation, likely functioning as an affiliate-based RaaS (Ransomware-as-a-Service) model given the high volume of disparate victims across multiple continents. Unlike closed groups, they exhibit the scalability of a platform, recruiting skilled access brokers.

Modus Operandi: They adhere to a strict double-extortion model, exfiltrating sensitive data (CAD designs, intellectual property, employee records) before detonating encryption. Ransom demands typically scale with the victim's revenue, generally ranging from $500k to $5m.

Initial Access Vectors: Current intelligence confirms a heavy reliance on exploiting vulnerabilities in perimeter network devices and remote management tools rather than traditional phishing. They are actively weaponizing CVEs in Check Point and Cisco Firewalls to bypass VPN authentication, alongside legacy exploits in ConnectWise ScreenConnect for RMM takeover.

Dwell Time: Estimated dwell time is short (3–7 days). Once access is established via a perimeter exploit, they move rapidly to lateral movement and data staging to minimize the window for detection.

Current Campaign Analysis

Sector Targeting: The recent data dump indicates a pivot towards critical operational verticals.

Manufacturing: High frequency (40% of recent victims: Buechel Stone, Cole Manufacturing, Traublinger, Buratti).
Energy: Critical infrastructure targeting (Maine Oxy).
Other Verticals: Education (Kozminski Univ), Agriculture (Fecovita, Mackay Sugar), and Public Sector (National Museum).

Geographic Concentration: While global (US, PL, FR, AR, DE, SG, DK, IT, AU, CA), there is a heavy density in the United States and Europe, specifically targeting industrial zones in DACH region (DE) and Poland.

Victim Profile: The targets are generally mid-to-large enterprise entities. In Manufacturing, the victims are likely long-standing firms with high-revenue operational technology (OT) dependencies but potentially lagging IT patch management on edge devices.

CVE Connection: This campaign is directly fueled by the exploitation of CISA KEV-listed vulnerabilities:

Perimeter Bypass: Active exploitation of CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco FMC) provides THEGENTLEMEN with valid VPN sessions, bypassing MFA.
Remote Access: CVE-2024-1708 (ConnectWise ScreenConnect) is likely used for fallback persistence or direct access in MSP-managed environments.

Detection Engineering

Sigma Rules

YAML

---
title: Potential Check Point VPN Gateway Exploitation CVE-2026-50751
description: Detects suspicious IKEv1 key exchange patterns or authentication failures followed by immediate success indicative of CVE-2026-50751 exploitation.
id: 7c3f9a12-8b4c-4d5e-9f1a-2b3c4d5e6f7g
status: experimental
date: 2026/06/15
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    category: vpn
detection:
    selection:
        dst_port: 500
        protocol|contains: 'IKE'
        action: 'accept'
    filter_legit:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter_legit
level: high
tags:
    - cve.2026.50751
    - attack.initial_access
    - thegentlemen
---
title: ConnectWise ScreenConnect Path Traversal Exploitation CVE-2024-1708
description: Detects exploitation attempts for ConnectWise ScreenConnect path traversal vulnerability leading to RCE.
id: 9d8e7f6a-5b4c-3d2e-1f0a-9b8c7d6e5f4g
status: experimental
date: 2026/06/15
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: webserver
    service: iis,apache
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/FlashService.axd'
            - '..%2f'
    selection_method:
        cs-method: 'GET'
    condition: all of selection_*
level: critical
tags:
    - cve.2024.1708
    - attack.initial_access
    - thegentlemen
---
title: Suspicious Ransomware Data Staging via Rclone
description: Detects the use of rclone for data exfiltration, a common tool used by THEGENTLEMEN affiliates for staging before encryption.
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
date: 2026/06/15
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith: '\rclone.exe'
    selection_cli:
        CommandLine|contains:
            - 'config create'
            - 'copy'
            - 'sync'
    condition: all of selection_*
level: high
tags:
    - attack.exfiltration
    - attack.t1041
    - thegentlemen

KQL Hunt Query (Microsoft Sentinel)

Hunts for lateral movement patterns associated with THEGENTLEMEN, specifically looking for remote service creation (PsExec/WMI) originating from non-standard admin workstations or suspicious accounts immediately following VPN authentication.

KQL — Microsoft Sentinel / Defender

let TimeRange = ago(7d);
let VPNAuthEvents = DeviceLogonEvents
| where Timestamp > TimeRange
| where LogonType == "VPN" or RemoteIP has_any("10.", "192.168.") // Basic filtering, adjust for specific VPN log source
| project Timestamp, AccountName, DeviceId, RemoteIP;
let LateralMovement = DeviceProcessEvents
| where Timestamp > TimeRange
| where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has_any ("-i", "-s", "-d", "Invoke-Command", "New-PSSession")
| project Timestamp, AccountName, DeviceId, ProcessCommandLine, InitiatingProcessFileName;
LateralMovement
| join kind=inner VPNAuthEvents on AccountName, DeviceId
| where LateralMovement.Timestamp between (VPNAuth.Timestamp - 1h) .. (VPNAuth.Timestamp + 4h)
| project Timestamp, AccountName, DeviceId, ProcessCommandLine, VPN_IP = VPNAuth.RemoteIP

PowerShell Response Script

This script checks for common ransomware precursors: creation of new scheduled tasks (often used for persistence/staging) and deletion of Volume Shadow Copies.

PowerShell

<#
.SYNOPSIS
    Incident Response script to detect ransomware precursors.
.DESCRIPTION
    Checks for recently created scheduled tasks and Volume Shadow Copy status.
#>

Write-Host "[+] Checking for Scheduled Tasks created in the last 24 hours..." -ForegroundColor Cyan
$Date = (Get-Date).AddDays(-1)
$Tasks = Get-ScheduledTask | Where-Object {$_.Date -gt $Date}
if ($Tasks) {
    Write-Host "[!] WARNING: Found recently created tasks:" -ForegroundColor Red
    $Tasks | Format-List TaskName, Author, Date
} else {
    Write-Host "[-] No suspicious recent tasks found." -ForegroundColor Green
}

Write-Host "[+] Checking Volume Shadow Copy Storage status..." -ForegroundColor Cyan
try {
    $VSS = vssadmin list shadows
    if ($VSS -match "No shadow copies found") {
        Write-Host "[!] CRITICAL: No Shadow Copies exist. Deletion may have occurred." -ForegroundColor Red
    } else {
        Write-Host "[-] Shadow Copies present." -ForegroundColor Green
    }
} catch {
    Write-Host "[!] Error checking VSS: $_" -ForegroundColor Yellow
}

Incident Response Priorities

T-Minus Detection Checklist:

VPN/Firewall Logs: Immediately review logs for Check Point and Cisco devices for anomalies on June 14-15, 2026. Look for successful logins without MFA prompts or IKEv1 floods.
ScreenConnect Audit: If ConnectWise ScreenConnect is in use, audit web server logs for /FlashService.axd requests.
Identity Provider: Check for impossible travel scenarios or authentication attempts from unusual geolocations correlating with the VPN logs.

Critical Assets for Exfiltration:

Manufacturing: CAD/CAM designs, proprietary formulas, ERP databases (SAP/Oracle).
Energy: SCADA interface documentation, PLC configurations, pipeline schematics.
All Sectors: Executive email archives, HR records (SSN/Tax info), and financial databases.

Containment Actions:

Isolate: Disconnect VPN concentrators from the internal network if exploitation is suspected.
Disable: Disable external access to RMM tools (ScreenConnect) until patched.
Credential Reset: Force reset of credentials for all service accounts and privileged users who logged in via VPN during the breach window.

Hardening Recommendations

Immediate (24h):

Patch: Apply patches for CVE-2026-50751 (Check Point), CVE-2026-20131 (Cisco), and CVE-2024-1708 (ConnectWise) immediately.
Block: Block inbound traffic to management interfaces (HTTPS/SSH) of firewalls and VPNs from the public internet; enforce access only via jump hosts or Zero Trust Network Access (ZTNA).
MFA Enforcement: Ensure phishing-resistant MFA (FIDO2) is enforced on all VPN and remote access entry points.

Short-term (2 weeks):

Network Segmentation: Enforce strict segmentation between IT and OT networks to prevent lateral movement from a compromised VPN host to critical manufacturing controllers.
Egress Filtering: Implement strict egress firewall rules to block known cloud storage endpoints (Google Drive, Dropbox, Mega) and non-standard protocols (SSH/FTP) from endpoints, breaking the exfil channel.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub