Ransomwarehigh
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-55591 | Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy | 9.8 | 94% | KEVRansomware | KEV |
| CVE-2025-32433 | Unauthenticated RCE in Erlang/OTP SSH Server | 10.0 | 99% | KEVPoC ×2 | KEV |
| CVE-2025-33073 | Improper Access Control Privilege Escalation in Microsoft Windows SMB Client | 8.8 | 83% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.120.22.127 | 26, Hunt.io said it discovered an open directory hosted at "176.120.22[.]127:80" on the Russian bulletproof hosting provider Proton66 |
From the original article
5 min read at thehackernews.com
A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis).
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.