SANS Threat Analysis Rundown in Review: Patched Is Not Evicted

Nov 11 2026

Breaking Down October 2026's Discussion: Inside CCB's Threat Actor Profile of The Gentlemen

Authored bySean O'Connor

This month's SANS Threat Analysis Rundown went deep on a single ransomware operation, and the reason it earned a full episode is not the malware involved. In roughly a year, the group known as The Gentlemen went from a Qilin affiliate crew in a $48,000 payment dispute to one of the two most active ransomware operations in the world. What they built is a platform: pre-compromised access handed to affiliates as a service, an EDR killer the operators maintain themselves, and a revenue split designed to recruit. If you own an internet-facing FortiGate, this one is about you.

I was joined by Kevin Holvoet, Threat Research Center Lead in the Cyber Threat Research and Intelligence Sharing (CyTRIS) department at the Centre for Cybersecurity Belgium (CCB), and a SANS instructor for FOR578. CCB published a TLP:CLEAR threat actor profile on The Gentlemen on September 30, and Kevin walked us through how a national CSIRT builds a report like that, what the group's May 2026 backend leak revealed, and what "presumed, not prospective" should mean for anyone patching edge devices. The timing was fitting: The SANS DFIR Summit opened the same day, and I chaired the ransomware track the following morning.

STAR stays practitioner-first: no vendor pitches, and no recycled headlines. This recap captures the references, reports, and resources that came up so you can dig deeper on your own time. You can catch the full replay on the SANS DFIR YouTube channel.

How a National CSIRT Builds an Actor Profile

We opened with what CyTRIS actually does, because the audience outside Europe does not always see this. Kevin has been at CCB for about ten years. CyTRIS is the intel team "and more": a fusion center hunting malicious infrastructure and potential victims, a team focused on Belgium's attack surface and the vulnerabilities that matter most to the country, a provider of daily advisories, and the maintainer of a Spear Warning process where CCB scans the country for vulnerable or compromised devices and sends warnings, physical letters included, before something happens. As Kevin put it, if CCB publishes on Fortinet, it probably matters to you wherever you are.

Why The Gentlemen, and why now? The idea started about a year ago when CyTRIS noticed that in any given quarter a handful of groups were simply more prolific than the rest. This one stood out for its techniques, its business model, how aggressively it recruited affiliates, and the sheer victim count.

On process, Kevin was specific:

One or two analysts collect everything available on the group: open reporting, TLP:AMBER material, commercial platforms, etc.
The team then asks what is peculiar about this actor. Ransomware is ransomware, but every group organizes, recruits, pays, and tools itself differently.
The analysis is structured around the Diamond Model, the intelligence lifecycle, and the kill chain, with MITRE ATT&CK techniques throughout and procedures added where the sourcing supports them. The report itself is built on the Diamond Model: adversary, capabilities, victimology, and infrastructure.

Information worth noting from the report's own scope section: The technical claims are drawn from and attributed to third-party vendor and incident response analysis rather than CCB sample analysis, and the assessments are CCB's own evaluation of that reporting. That transparency about sourcing is a model worth copying. It is also the same Diamond Model structure we use on the cybercrime underground day in FOR589: Cybercrime Investigations, with adversary, capability, victimology, and infrastructure modules and an infrastructure workshop built on it.

The Business Model: A 90/10 Split and Better Tooling

The most distinctive thing about The Gentlemen is how they pay. The report describes a roughly 90% affiliate share against an industry norm of 70 to 80%, with a reportedly higher share on a data-only extortion track that skips encryption entirely. I asked Kevin whether that, together with the recruitment path from RAMP to Rehub to BreachForums, was a recruitment play or speculation.

His answer: it is a recruitment play, and the history explains it. As far as CCB can tell, the crew were Qilin affiliates who split off in what looks like a structured separation rather than a war. They built their own group, infrastructure, and way of working from a core of about nine people, and they went to market with what they had wanted as affiliates themselves: more money for the same work, plus better tooling. Kevin's framing was blunt. If someone offers you a 30% raise to do the same job with better tools, what would you do? My analogy was a barber shop paying its contractors more per client. Of course they move, especially if the service is better.

So what makes the service better? Two things came up:

Tooling supplied as a service. Affiliates get toolkits for initial access and lateral movement, and the platform is heavily invested in bring-your-own-vulnerable-driver (BYOVD) capability. CCB's report describes a BYOVD suite targeting more than 400 process names mapped to 48 security products.
A standing focus on EDR evasion. Companies have better security than they used to, and the group's answer is to keep developing new ways around it. Kevin's point was that EDR is better than antivirus for some things, antivirus still matters for others, and the layered approach is what holds up.

The report also notes roughly 20 members overall around that core, and that recruitment moved from RAMP to Rehub after RAMP was seized in early 2026, then to a formal BreachForums partnership after the leak, targeting penetration testers and initial access brokers specifically.

The FortiGate Inventory: "Presumed, Not Prospective"

The number that stopped me when I read the report was the internal dashboard titled "FortiGate Inventory Overview," built by exploiting CVE-2024-55591 and listing an estimated 14,700 compromised FortiGate devices across multiple countries, alongside a separate cache of 969 validated, brute-forced VPN credentials. The report's recommended action is to treat FortiGate compromises as presumed, not prospective. I asked Kevin what that looks like for a defender on Monday.

His first move was to widen the lens. The group has a Fortinet library, but the real target is edge devices generally: VPNs, firewalls, anything on the perimeter that is supposed to protect you. If a device has had a vulnerability for days or weeks, there is a good chance someone already exploited it. The analogy he used was a boat. Patching fixes the hole, but the water is still inside. You need pumps.

What that means in practice:

Do not trust the patch alone. A patch closes one hole. It does not remove a web shell, an extra account, or a configuration change that was planted before you patched.
Baseline and compare. Know your normal configuration on every edge device. Is there an account you have never seen? A file that should not be there?
Use the vendor's integrity tooling. Fortinet provides integrity checks. They are not perfect, but running one after every patch, automated if you can, is a good habit. Vendor advisories increasingly include integrity checkers and indicators for actively exploited bugs, and Kevin credited vendors for that maturity.
Patch fast, then hunt. Speed still matters, and Kevin noted AI is another factor on that clock. But patch management now has to include checking logs, configuration, and anything different from the last time you looked.

On what prior compromise actually looks like on these devices, Kevin kept it simple and drew on public reporting and other incidents: changed admin passwords, modified VPN configurations, tampered multi-factor authentication, ports or services opened up, and new full-admin accounts that are not connected to Active Directory and sit hidden in the device's local configuration. He also pointed out how often none of that was needed because the device had a weak or near-default password. His guidance was to check your version and patch level against the report and the Fortinet advisories, because what you should expect to find depends on which vulnerability applied to you.

His closing warning on this topic is the one I want people to sit with: plenty of organizations are still on that list, fully patched, confident they are fine, while an initial access broker has been inside for three months and already sold the access on.

When the Hunters Get Hunted: The May 2026 Leak

In May, The Gentlemen's own Rocket.Chat collaboration platform was compromised. The report ties that to a reported leak at 4VPS, a hosting provider the group used, which 4VPS itself disclosed on May 2. What came out included internal account credentials, months of chat logs, ransom negotiation transcripts with settlement figures, the CVEs the group was tracking as live priorities, and evidence of AI coding assistants being used to build the affiliate panel, which the administrator claimed took a matter of days. I pulled up SOCRadar's write-up of the leak on screen, and Kevin was quick to credit the companies and researchers who published, because that is what made a single consolidated report possible.

What the leak changed about CCB's understanding of the group:

It is a small group that runs like a business. About nine core people, around twenty overall, with money laundering and cash-out services, negotiators, people recruited for language skills, and, according to Kevin, lawyers brought in to find regulatory exposure in stolen data that can be used as leverage.
They buy initial access rather than breaking in themselves. Beyond the FortiGate inventory, the chats show a strong focus on recruiting and contracting initial access brokers.
They shop on the legitimate market too. The group held commercial subscriptions to credential intelligence and breach-search platforms to query infostealer logs from families like RedLine, Lumma, and Vidar. Kevin's point: They are not only on the dark web. They buy the same subscriptions we do.
They have the money to invest. Kevin was careful to say this is not specific to The Gentlemen, but look at the crypto wallets across these groups and there are millions in them, often more than a smaller company has. Anything they build can be sold back to affiliates, which makes them stronger.
Dual-use tooling cuts both ways. Velociraptor, a tool blue teams use for hunting and endpoint response, shows up in their intrusions. If nobody in your environment uses Velociraptor and it starts moving around, you should be able to see that.

That last point led to a thread that I think matters beyond this group. Criminals gaining legitimate access to CTI platforms and frontier AI models highlights a need to work with GRC on know-your-customer controls, because some of them are walking in the front door with a credit card. Kevin's corollary was the useful one for defenders: If they can buy visibility into your leaked credentials from a legitimate platform, so can you. Use it.

On how analysts should handle leaked criminal data as evidence, Kevin was pragmatic. First, know your local law. Some jurisdictions prohibit downloading stolen data. If you can dig in, focus on understanding the business structure and the tooling they hand to their customers, which is what affiliates are. Note which CVEs they target, how fast they react to new disclosures, and how quickly they turn proof-of-concept code into working exploits. Then structure it. The kill chain, the Diamond Model, and MITRE ATT&CK exist to turn chatter into something you can act on. Otherwise it is just noise between criminals.

My framing on air was that CTI runs on three telemetries. Traditional intrusion telemetry is the one everyone knows. Blockchain is the second: Wallet infrastructure tells you about actor infrastructure, the TTPs tied to it, and the capabilities it funds. The third is the noise from Rocket.Chat, Telegram, Jabber, and underground forums. That third stream is the hardest to make actionable, but once you map it to a framework, it feeds security controls like anything else.

Reading the Numbers: Leak Sites, Dark Figures, and Chain Victimization

The report contains a stat that should change how everyone reads a leak site. A SystemBC command-and-control server operated by an affiliate showed more than 1,570 compromised organizations in its own records at a time when the public leak site listed roughly 320 named victims. The report's read is that approximately 70 to 80% of victims paid quietly and were never published. The report is careful to note it could not determine whether SystemBC is integrated into the group's ecosystem or is one affiliate's tool of choice.

Kevin's take on the dark figure:

The leak site is a floor, not a count. Many of the organizations on that SystemBC list appeared flagged as done but never showed up publicly.
Reporting obligations help, but only for those covered. In Europe, regulated entities have to report. Smaller companies outside that regime are the ones deciding, as a business decision, to pay $50,000 to get back to work and make payroll. CCB's position is still do not pay, but Kevin was honest that it is a business decision victims make.
Leverage is engineered from the data. The chats show the group hunting for regulatory exposure ("pay or we go to the regulator") and for the victim's customers, who are then told the company holding their data has been breached and offered a side deal to keep their slice unpublished.

On chain victimization, the report documents a case where the group breached a consultancy, held far more data than the victim's public disclosure acknowledged, used that regulatory exposure as leverage, then used the stolen data to compromise one of the consultancy's clients through a separate vulnerability and published the client while naming the consultancy as the "access broker." Kevin extended it to the MSP and provider pattern: Vendors that require direct access into your environment as part of the contract become your breach when they are breached. His law-firm example landed hard. Attorney-client privilege means nothing when the firm's notebooks are on the street.

My takeaway for defenders is that third-party risk cannot stop at the questionnaire. A vendor incident response program needs to know what level of data sharing exists with each vendor and what tooling or infrastructure that sharing runs through, so you can put preventive or detective controls around it when that vendor has an incident.

Two related points Kevin raised that belong in the same conversation:

Targeting is opportunistic, and the economics are predictable. Affiliates go after what is vulnerable, what has a large attack surface, what has money, and what cannot tolerate downtime. His example was a company with revenue above $50 million, 50 people, and one person covering IT, security, CTI, and threat hunting at once. GRC has to be part of the answer: Identify the crown jewels as data, processes, and services rather than servers, then patch, prioritize, and monitor those first. That is asset management and a real CMDB, which is not glamorous, but it is the foundation.
Cyber insurance documents are a target. The leaked chats show the group looking for insurance paperwork and pricing the ransom against the policy. The report describes this as insurance-aware ransom pricing. Someone recently told Kevin that insurance data should never live digitally in the environment, and he passed it on as advice worth considering.

What Defenders Should Do Monday

I read the opening line of the report's recommendations on air because it is the thesis of the episode: Defense against The Gentlemen does not require novel controls. Every documented technique is addressed by existing CyberFundamentals requirements at the Essential assurance level (see below for more on this framework). What the actor demands is a change of emphasis. The report then lists four actions in order:

Treat FortiGate compromises as presumed, not prospective. Patch the nine documented CVEs, hunt retrospectively on every internet-facing FortiGate, rotate credentials on suspected compromise, run root-cause analysis rather than assume the device stayed clean, and audit privileged identities afterward.
Break the propagation chain, not just the initial vector. Segmentation, disabling unnecessary services, and strict separation of administrative privileges.
Make backup recovery survive a domain compromise. The actor targets Veeam credentials and backup databases directly. Kevin's version: Everything you back up should be somewhere offline and air-gapped, because they hunt for your backups and sometimes go after them first to establish leverage.
Restrict which software and drivers are allowed to run at all. Use allowlisting rather than blocklisting, because the group weaponizes newly disclosed driver vulnerabilities within days. Kevin's practical model: Start from a golden image, put approvals behind a process, keep a record of what normal looks like per machine, and alert when a tool or DLL shows up on a domain controller where it never belonged.

I asked which of the four is hardest in practice. Kevin's answer was to take them as a set in that order rather than picking one, because the order reflects what CCB sees the group using most right now.

On CyberFundamentals (CyFun), for readers outside Belgium: It is CCB's framework built by combining NIST CSF, the IEC industrial control standards, and the CIS Critical Security Controls, using the NIST CSF core-function structure. It is split into assurance levels so it works for small organizations as well as large ones, starting with basics like MFA, backups, and identity control. Kevin's claim is that the basic level alone protects against roughly 80% of observed attacks on average, and that other European countries have already adopted the framework. CCB maps its recommendations to CyFun alongside ATT&CK specifically so the report is usable by anyone, anywhere.

A few details from the report that did not get airtime but belong in your hunt plan:

The actor uses wevtutil to clear only the System, Application, and Security logs. PowerShell operational logs and Defender logs are left intact, and the report says those are sufficient to reconstruct the attack. Ship them off-host.
The self-propagation module attempts up to 21 independent remote execution paths per reachable host, per Microsoft's count. One success on one additional host is enough to keep propagation going.
The locker's --gpo flag runs encryption domain-wide from a compromised domain controller.

The Monday ask I closed with: pick one. If you own an internet-facing FortiGate, hunt on it as if it is already in the inventory. If you run Veeam, prove your recovery works when the domain is gone. If you are still blocklisting drivers, start the allowlist conversation.

Getting the Indicators: CCB's MISP Event

CCB published a dedicated MISP event alongside the report (UUID f5039e52-0fc2-4e36-bd5e-41822ee904b0) containing the indicators and TTPs CCB collected on The Gentlemen over roughly the past year. Kevin's guidance on access:

Belgian organizations: Search for MISP on belgium.be and request access by email, or register through Safeonweb@Work, which also lets CCB warn you directly when it scans your infrastructure. The report asks requesters to state whether they want a server-to-server connection or a read-only account, via info@ccb.belgium.be.
Everyone else: Connect through CIRCL, the maintainers of MISP, and their MISP communities. CCB shares all of its TLP:CLEAR events there, including this one.

Once you have it, push it into your firewall and SIEM and run a retrospective search over the last few months of logs.

Links and Reports Shared During the Livestream

The Episode

SANS Threat Analysis Rundown (STAR) Livestream Series, SANS
SANS DFIR on YouTube (replay channel), SANS
SANS DFIR Summit and Training 2026, SANS
Episode announcement, Sean O'Connor, LinkedIn
Episode announcement, SANS, LinkedIn

Centre for Cybersecurity Belgium and CyTRIS

Shown on Screen or Discussed

Inside The Gentlemen Ransomware Leak: When the Hunter Becomes the Hunted, SOCRadar
DFIR Report: The Gentlemen and SystemBC, A Sneak Peek Behind the Proxy, Check Point Research
PSIRT advisory FG-IR-24-535 (CVE-2024-55591), Fortinet

Frameworks and Reference Material

MITRE ATT&CK Enterprise Matrix, MITRE
Traffic Light Protocol (TLP), FIRST

Additional References from the CCB Report

Every source cited in CCB's bibliography, grouped by theme. Not all were discussed on air, but they form the evidentiary base for the report and are worth keeping in one place.

Going Deeper with SANS

If you want to keep building on what we covered this month:

FOR578: Cyber Threat Intelligence covers the analytic structure Kevin's team used to build this profile: the Diamond Model, the kill chain, ATT&CK mapping, and source evaluation when your evidence is other people's reporting. Kevin teaches it, and he was in Prague teaching it the week of the episode.
FOR589: Cybercrime Investigations goes deep on the ecosystem this episode kept returning to: affiliate economics, initial access brokers, infostealer log markets, how to work leaked criminal data as evidence, and how blockchain and underground telemetry feed the same intelligence picture as intrusion data.
SANS DFIR Summit and Training 2026 ran the same week as this episode and included a dedicated ransomware track. If you missed it, the summit page is the place to look for the talks.

Coming Up Next

Next month on STAR, we will be back with another guest and another working-level conversation on what is actually moving in the threat landscape. Catch the replay of this episode and register for upcoming livestreams at the SANS Threat Analysis Rundown page.

Thanks to everyone who joined live or is catching the replay, and a special thanks to Kevin Holvoet and the CyTRIS team at CCB for putting a report this thorough into the public domain and then taking an hour to walk us through it. See you next time.

Meet Your Author

Sean O'Connor

Certified Instructor Candidate

Sean O’Connor is a cybersecurity professional with over 15 years of experience in intelligence, digital forensics, and threat analysis across both the private and public sectors.

SEC536: Adversarial AI - Penetration Testing AI Systems