THEGENTLEMEN Ransomware: Global Surge Exploiting Check Point & Cisco Perimeter Flaws

Date: 2026-06-10 Analyst: Security Arsenal Intel Team

Threat Actor Profile — THEGENTLEMEN

Operational Model: THEGENTLEMEN operate as a Ransomware-as-a-Service (RaaS) entity, leveraging an affiliate network to distribute their payload. Unlike closed groups, they maintain a high victim throughput, evidenced by the recent batch of 15 postings in a single day (2026-06-08).

Tactics & Procedures:

• Initial Access: Heavy reliance on perimeter exploitation, specifically targeting VPN and firewall appliances. Recent intelligence correlates their activity with the exploitation of CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco Secure Firewall). They also utilize legacy remote access vulnerabilities (CVE-2024-1708) for persistence.
• Extortion Strategy: Strict double-extortion model. Victims are given a short window (typically 48-72 hours) to negotiate before data is leaked.
• Dwell Time: Estimated between 3 to 7 days. The gang moves rapidly from initial access to data exfiltration to minimize detection chances.

Current Campaign Analysis

Campaign Overview: On 2026-06-08, THEGENTLEMEN released a massive batch of 15 victims, indicating a successful automated exploitation of a specific vulnerability or a coordinated affiliate effort.

Sector Targeting: The campaign shows a distinct pivot towards Healthcare and Technology, though they remain opportunistic across sectors.

• Healthcare (High Priority): WCM Remedium (PL), The Clinic (GB), Central Arkansas Pediatrics (US).
• Technology: Yao Yuan Technology (TW), IP Rings (IE).
• Logistics/Manufacturing: Integrated Distribution (GB), Jyharn Electronic (TW).

Geographic Dispersion: The operation is highly globalized, impacting:

• Europe: PL, GB, RU, ES, IE
• Asia-Pacific: JP, HK, TW
• Americas: US, AR

Victim Profile:

• Mid-to-large market enterprises (MME).
• Revenue estimates range from $10M to $500M based on target profiles (e.g., FESCO Adecco, Goldlion).

CVE Correlation: There is a high temporal correlation between the posting date (2026-06-08) and the addition of CVE-2026-50751 (Check Point Security Gateway) to the CISA KEV list on the same day. We assess with high confidence that THEGENTLEMEN affiliates are actively exploiting this IKEv1 authentication bypass to gain VPN access, bypassing MFA requirements.

Detection Engineering

Sigma Rules

The following rules detect the specific perimeter exploits and internal lateral movement associated with this campaign.

title: Potential Check Point IKEv1 Authentication Bypass
id: 4a8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 exchanges and anomalies in VPN authentication logs.
status: experimental
date: 2026/06/10
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: checkpoint
definition: 'TODO: define mapping'
detection:
    selection:
        product|contains: 'VPN'
        ike_version: 'v1'
        action|contains: 'key_exchange'
    filter:
        src_ip_network:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter
falsepositives:
    - Legitimate IKEv1 VPN connections from legacy partners
level: high

title: ConnectWise ScreenConnect Path Traversal Exploitation
id: b5c2d3e4-f6a7-8b9c-0d1e-2f3a4b5c6d7e
description: Detects exploitation of CVE-2024-1708 via suspicious URI patterns in ScreenConnect logs.
status: experimental
date: 2026/06/10
author: Security Arsenal
logsource:
    category: web
detection:
    selection_uri:
        cs-uri-query|contains:
            - '..%5c'
            - '..\\'
            - '.aspx?'
    selection_status:
        sc-status: 200
    condition: selection_uri and selection_status
falsepositives:
    - Unknown
level: critical

title: Suspicious PsExec Lateral Movement
id: c6d3e4f5-a7b8-9c0d-1e2f-3a4b5c6d7e8f
description: Detects the use of PsExec for lateral movement, a common TTP for THEGENTLEMEN affiliates prior to encryption.
status: experimental
date: 2026/06/10
author: Security Arsenal
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\psexec.exe'
            - '\psexec64.exe'
        CommandLine|contains:
            - '\\'
            - '-accepteula'
    condition: selection
falsepositives:
    - Administrative IT tasks
level: high

KQL (Microsoft Sentinel)

Hunt for signs of data staging (large file copies to non-standard locations) and credential dumping often seen before detonation.

// Hunt for suspicious data staging or large file modifications
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName in~ ("robocopy.exe", "rclone.exe", "winscp.exe", "7z.exe", "winrar.exe")
| where ProcessCommandLine contains "\\" or ProcessCommandLine contains "/"
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort in (80, 443, 22) and InitiatingProcessFileName !in~ ("chrome.exe", "edge.exe", "firefox.exe"))
    on DeviceName, Timestamp
| distinct Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl

Rapid Response Script

PowerShell: Enumerate recently created Scheduled Tasks (Persistence mechanism) and check for Shadow Copy manipulation (Defense Evasion).

# Check for Scheduled Tasks created in the last 24 hours
$DateCutoff = (Get-Date).AddDays(-1)
Get-ScheduledTask | Where-Object {$_.Date -gt $DateCutoff} | Select-Object TaskName, TaskPath, Date, Author

# Check Volume Shadow Copies for recent deletions (often pre-encryption)
$vss = Get-WmiObject -Class Win32_ShadowCopy
if ($vss.Count -lt 1) {
    Write-Host "WARNING: No Volume Shadow Copies found. This may indicate deletion." -ForegroundColor Red
} else {
    Write-Host "Shadow Copies Present: $($vss.Count)"
}


---

Incident Response Priorities

1. T-Minus Detection Checklist:

   • Check Point Logs: Immediately audit VPN logs for IKEv1 connections on 2026-06-08 or 2026-06-09. Look for successful authentications from geolocations inconsistent with employee travel.
   • ScreenConnect Audit: If deployed, review web server logs for path traversal attempts (..\ or %5c).
   • Exchange Server: Review IIS logs for deserialization anomalies (CVE-2023-21529).

2. Critical Assets at Risk:

   • Based on victimology (Healthcare/Tech), expect exfiltration of PII/PHI, IP/Source Code, and Financial Records.

3. Containment Actions:

   • Urgent: Disable IKEv1 on Check Point Security Gateways immediately.
   • High: Isolate any systems identified with suspicious PsExec or WMI execution patterns.
   • Medium: Force-reset passwords for accounts that logged in via VPN during the breach window.

Hardening Recommendations

Immediate (24h):

• Disable IKEv1: Enforce IKEv2 only on all VPN concentrators to mitigate CVE-2026-50751.
• Patch ScreenConnect: Ensure ConnectWise ScreenConnect instances are updated to the latest build to patch CVE-2024-1708.
• Block RDP: Restrict RDP (TCP 3389) from the internet via firewall policies.

Short-term (2 weeks):

• Network Segmentation: Segment critical backup repositories from the general network to prevent mass deletion.
• Phishing Resiliency: Deploy MFA fatigue protections and conditional access policies for remote administration tools.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub