Last Friday, The Gentlemen ransomware group added a new victim to its leak site: All Souls St Gabriels School, an Anglican boarding and day school in Charters Towers, North Queensland. The group gave the school four days before it would start publishing what it says it took.
The school has handled the public side of this well. It confirmed that an unauthorised party accessed part of its systems, said it moved immediately to secure them, brought in forensic specialists, told parents and staff, and notified the Australian Cyber Security Centre. It has also said it will contact affected people directly if personal information is involved. That is what a good and a swift response looks like, and nothing in this article is a criticism of the people dealing with it right now.
What we want to do is to shed some light on The Gentlemen, how do they actually get in, and what should a school (or any organisation) be doing about it before it is their name on the list?
Not much about the cause. Nobody outside the investigation knows how this school was breached. The school has not said, the group has not said, and the forensic work is ongoing.
What we do have is a large and growing body of research on how this group and its affiliates operate. Group-IB, Trend Micro, ESET, Check Point and others have pulled apart their tooling, their affiliate chats and real incident data. The Gentlemen are a fairly disciplined operation with a repeatable playbook, so when they hit a new victim, the odds are good it followed a familiar path. That playbook is what this article is about.
The Gentlemen is a ransomware as a service (RaaS) operation that surfaced in mid 2025 and has grown faster than almost any ransomware operation we have tracked. Comparitech counted 600 claimed attacks in the first seven months of 2026 alone, second only to Qilin. Check Point puts them at number two by victim count for the year, and Cyber Daily reported the same ranking this week.
The group is run by a Russian speaking operator known as "hastalamuerte", who previously worked as an affiliate of Qilin before a public falling out over an unpaid share of around $48,000. According to Group-IB, the crew is roughly 20 people and runs as ransomware as a service. Affiliates do the break-ins and keep 90 per cent of any ransom, which is well above the industry norm of 70 to 80 per cent. That generous split is pulling experienced criminals away from other programs, and it is a big part of why the numbers have climbed so quickly.
Australia is firmly on their map. Before this school, Cyber Daily reported Gentlemen listings for Newcastle IT and office supplier Sharp Office in September and children's wear retailer Ollie's Place in August. CI-ISAC Australia issued an advisory in August noting that affiliates had already got into several Australian organisations this year across education, retail, transport, health, finance and critical infrastructure.
The important thing to understand is that this group is opportunistic. They are not picking schools because they hate schools. They are scanning the internet for doors that are easy to open, then working out who is behind them.
If there is one thing to take away from this article, it is this: The Gentlemen's favourite front door is the firewall.
Specifically, Fortinet FortiGate firewalls and their SSL VPNs. Group-IB's analysis of the group's internal material found that the operator hands affiliates ready made lists of compromised FortiGate devices, around 14,700 of them at one point, along with scripts that pull credentials out of firewall configurations and feed them straight into the next stage of the attack. Affiliates are told to favour FortiGates connected to Active Directory through LDAP, because a VPN account that is also a domain account makes everything that follows much easier.
They get those firewalls in a few ways:
It is worth adding some context here. In June this year, a dataset dubbed "FortiBleed" leaked VPN credentials and configuration data for roughly 74,000 Fortinet devices worldwide. Nobody has tied that leak to The Gentlemen, and we are not suggesting it is connected to this school. But it shows how much FortiGate access is floating around the criminal market, and why a firewall you have not looked at closely in a while deserves your attention this week.
Once inside the firewall, affiliates commonly create backdoor admin accounts, set up a quiet "guest" VPN account for themselves, and steal the device configuration so they can mine it for more credentials.
From here the attack moves fast and follows a pattern that will be familiar to anyone who has done incident response.
Map the network. They use ordinary admin tools like Advanced IP Scanner, Nmap and NetExec to enumerate Active Directory and find the domain controllers, the file servers, the backup server and the people with Domain Admin rights.
Blind the defences. This is where The Gentlemen stand out. Most ransomware gangs leave it to affiliates to deal with security software. The Gentlemen supply their own toolkit for it. ESET's research in June described "GentleKiller", an in house EDR (endpoint detection and response) killer with at least eight variants that targets more than 400 security processes from 48 different vendors. It works by loading a legitimately signed but vulnerable Windows driver (a technique known as bring your own vulnerable driver) and using it to switch off your antivirus and EDR from the kernel, where tamper protection cannot stop it. They also turn off Microsoft Defender's real time protection, add exclusions for the whole C: drive and clear the event logs.
Grab the keys. They go hunting for credentials, and one of their favourite places to look is the backup server. Group-IB documented affiliates extracting stored credentials from Veeam's database and exploiting an older Veeam flaw (CVE-2023-27532) to do it. Tools like Mimikatz and DonPAPI pull passwords and secrets from memory and from users' browsers. The aim is Domain Admin, and they usually get there.
Stay put. They install remote access tools like AnyDesk so they can get back in even if the original door is closed, and create new domain accounts quietly added to privileged groups.
Take the data. Before anything is encrypted, files are gathered into a staging folder and pushed out using WinSCP or a renamed copy of Rclone, sometimes over an encrypted tunnel. This is the "double extortion" part. Even if you can restore from backup, they still have your data and will threaten to publish it.
Encrypt everything at once. The final blow is delivered through Group Policy. The ransomware is placed in the domain's NETLOGON share and a policy is pushed out so that every domain joined machine runs it at roughly the same moment. They also have dedicated lockers for VMware ESXi and Linux, and a script that switches off high availability in vCenter and powers down virtual machines before encrypting them. Shadow copies are deleted, logs are wiped, and a note called README-GENTLEMEN.txt is left behind.
Check Point, which responded to one of these incidents, found the attacker already had domain administrator access when they arrived and that whole networks can be encrypted within hours of entry. By the time the ransom note appears, the real damage was done days earlier.
Schools are not more valuable than banks. They are just, on average, a lot easier to get into, and the data they hold is about as sensitive as it gets.
Think about what a boarding school keeps on file. Enrolment records going back decades. Medical information, medication plans and allergy records for every child. Parent contact details, financial records and fee arrangements. Custody orders, family court documents and pastoral care notes. Staff records, payroll and working with children checks. For boarders, that list gets longer. This is exactly the kind of material that makes extortion work, because the school's first instinct is to protect the children and families involved.
At the same time, most independent schools run lean IT teams, often one or two people or an outsourced provider, looking after a large and messy environment. There are hundreds of staff and student devices, BYOD programs, a long tail of education apps, and usually a single firewall and VPN that everyone relies on and nobody wants to touch during term. Holidays and weekends, when nobody is watching the alerts, are a gift to an attacker.
None of that is a failing of the people involved. It is a resourcing reality. But it does mean the controls need to be chosen carefully, because there is no room for anything that does not pull its weight. Our Australian Education Cyber Threat Report looks at the sector's risks in more depth.
Before we get into the detail, here is where we would start. If you are a principal, business manager or board member wondering what to ask your IT team on Monday, these are the three things.
Almost every Gentlemen intrusion we have read about started with something basic: a weak or reused password, a VPN without MFA, or a firewall that had not been patched. None of these need a big budget to fix.
The Gentlemen work at night, on weekends and during school holidays, and once they have admin access they can go from data theft to encryption in hours. A small IT team, however capable, cannot watch for that around the clock. A 24/7 Security Operations Centre (SOC), whether in house or as a managed service, gives you people and tooling watching your environment all the time, with the authority to act.
A good SOC should detect and alert you to the signs of this kind of attack while there is still time to stop it: logins from unusual locations or at unusual hours, new admin accounts and Group Policy changes, security tools being switched off, remote access software appearing where it should not, and large volumes of data heading out of the network. That last one matters most for double extortion. If you catch the exfiltration, you can often contain the incident before anything is encrypted or leaked. Ask any provider how quickly they will call you, and what they are authorised to do on your behalf at 2am.
Most schools and businesses do not know exactly where their most sensitive data sits, which makes it hard to protect and even harder to work out what was taken after an incident. Data Loss Prevention (DLP) helps with both.
If you are on Microsoft 365, Microsoft Purview gives you the tools to classify sensitive information and control how it moves. It has built in detection for Australian data such as Tax File Numbers, Medicare numbers, driver licences, passport numbers and bank account details, and you can add your own types for student records, medical plans or custody documents. From there you can apply sensitivity labels, set policies that block or alert when that data is shared externally, uploaded to personal cloud storage or copied to USB, and use endpoint DLP to watch what happens on devices and servers. Schools running Google Workspace have equivalent DLP controls built in.
Start in audit mode so you can see how data is actually being used before you block anything, then tighten the policies over a few weeks. Two practical notes: some of the more advanced Purview features, including endpoint DLP, need the higher tier Microsoft 365 licences, and DLP works best when its alerts feed into your SOC, so they land in front of someone who can act on them.
Once those three are underway, these are the controls we would prioritise next, in roughly this order, if we walked into a school tomorrow. Most of them map straight onto the ASD Essential Eight, which is no coincidence.
This is the one that matters most against this group. Confirm your firewall firmware is current and that CVE-2024-55591 and any other critical FortiOS issues are patched. Make sure the management interface is not reachable from the internet at all. Review the admin accounts and the VPN user list for anything you do not recognise, including accounts called "guest" or anything created recently. If your device was exposed and unpatched for any length of time, treat it as possibly compromised, rotate every admin and VPN password, and end all active sessions. If you run Fortinet gear, check whether your devices appear in the FortiBleed data using Hudson Rock's free lookup.
Every VPN login, every admin console and every remote access tool should require MFA, ideally a phishing resistant method like passkeys or FIDO2 keys for anyone with admin rights. Turn on account lockout so password guessing fails. And think hard about whether your VPN needs to be wired to Active Directory accounts with broad rights, because that link is exactly what this group is looking for.
Infostealer malware on a teacher's home laptop can hand over their school login without anyone noticing. Monitor for your domain appearing in credential leaks and infostealer logs, force resets when it does, and keep personal devices off admin functions entirely. Short session lifetimes and conditional access rules for Microsoft 365 and Google Workspace help limit what a stolen session cookie is worth.
Admins should use separate accounts for admin work and never browse or check email with them. Use Windows LAPS so local admin passwords are unique on every machine. Then alert on the things this group always does: new accounts added to Domain Admins, new or changed Group Policy objects (Windows events 5136 and 5137), and files written to NETLOGON or SYSVOL. Those signals still fire even if your EDR has been killed, and catching a rogue GPO before it runs is the difference between an incident and a catastrophe. An Active Directory and Entra ID security assessment will show you where those gaps are.
Turn on Microsoft's vulnerable driver blocklist and Memory Integrity (HVCI) on every Windows device you can. Make sure tamper protection is enforced in Defender for Endpoint or whatever EDR you run. Most importantly, treat a device that suddenly stops reporting to your EDR as a live incident, not a glitch. Application control, which sits at the higher maturity levels of the Essential Eight, also stops unapproved tools like AnyDesk, Rclone and WinSCP from running in the first place.
A one or two person IT team cannot watch alerts at 2am on a Saturday in the middle of school holidays. These attacks are timed for exactly those moments. A managed detection and response service or a third party SOC is the realistic way for most schools to get 24/7 coverage, and it does not need to cost what people assume.
Your backup server is one of the first places this group goes. Keep it off the domain, give it its own credentials with MFA, patch it, and keep at least one copy immutable or offline where a Domain Admin account cannot delete it. Then test a full restore, not just a file or two. A backup you have never restored is a hope, not a plan.
Egress filtering that blocks or alerts on unexpected SFTP, cloud storage uploads and tools like Rclone makes data theft noisier and slower. Just as important is not keeping what you do not need. Many schools hold records on students who left decades ago. A sensible retention schedule means there is simply less to steal and less to explain to families if the worst happens.
Many schools rely on a managed service provider with standing remote access to everything. That access is a path in for an attacker too. Ask your provider how their own admin accounts are protected, whether they use MFA on every tool that touches your network, and what remote access software they have installed on your systems.
Run a tabletop exercise built around exactly this scenario: data stolen, systems encrypted, a leak deadline ticking, and parents calling. Work out in advance who calls the forensic team, who talks to families, who notifies the ACSC and the regulators, and who makes the decision about a ransom demand. Independent schools with turnover above $3 million are covered by the Privacy Act and the Notifiable Data Breaches scheme, and since May 2025 any organisation above that threshold that pays a ransom must report the payment to the ASD within 72 hours. Better to know your obligations on a calm Tuesday than to learn them during a crisis. Our incident response readiness assessment is built around exactly this kind of exercise.
Yes. Strip out the bits about students and boarders, and every control above applies to a manufacturer, a retailer, a clinic, a council or a law firm. The Gentlemen's most targeted sectors are manufacturing and technology, followed by healthcare. Their playbook does not change much between victims, which is good news for defenders, because it means a small number of controls cut off most of the attack.
If you take nothing else from this, start with our three recommendations: get the basic hygiene right, have someone watching around the clock, and know where your sensitive data lives and control where it goes. Then work through the rest of the list at whatever pace your budget allows.
The Gentlemen is a ransomware as a service (RaaS) operation that emerged in mid 2025. It is run by a Russian speaking operator known as "hastalamuerte" and lets affiliates keep 90 per cent of each ransom. It uses double extortion, stealing data before encrypting systems, and has lockers for Windows, Linux and VMware ESXi.
Mainly through internet facing firewalls and VPNs, especially Fortinet FortiGate devices. Affiliates exploit known flaws such as CVE-2024-55591, guess weak or default VPN passwords, and use credentials stolen by infostealer malware. Exposed RDP and remote management tools are also used.
GentleKiller is The Gentlemen's in house EDR killer, described by ESET in June 2026. It loads signed but vulnerable Windows drivers to terminate more than 400 security processes from 48 vendors at the kernel level, so affiliates can run their tools without being detected.
Researchers have observed a ransom note named README-GENTLEMEN.txt and encrypted files renamed with the .7mtzhh extension. The group also deletes shadow copies and clears Windows event logs before and after encryption.
Yes. Beyond All Souls St Gabriels School in October 2026, Cyber Daily has reported Gentlemen listings for Sharp Office in September and Ollie's Place in August, and CI-ISAC Australia has warned that affiliates got into several Australian organisations during 2026.
Start with strong passwords, MFA on all external access, geo blocking logins from outside Australia and fast patching of firewalls and VPNs. Then add 24/7 monitoring through a Security Operations Centre and Data Loss Prevention to spot and stop data leaving the network. Protected, tested backups and a rehearsed incident response plan round it out.
Yes, if the organisation has an annual turnover above $3 million. Since 30 May 2025, the Cyber Security Act 2024 requires those organisations to report any ransomware payment to the Australian Signals Directorate within 72 hours of making it or becoming aware it was made.
Education is one of the sectors we work in most closely, and we have seen the same handful of gaps come up again and again. If you want a clear view of where you stand against this group's playbook, we can help with a focused review of your firewall and remote access, an Active Directory and privileged access assessment, an external attack surface check, a ransomware readiness assessment, or a full compromise assessment if you suspect something is already wrong. If you are dealing with an incident right now, our emergency cyber breach response team can help. Sometimes the most useful thing is simply a second set of eyes on the edge of your network before someone less friendly takes a look.
Spartans Security is a CREST accredited cyber security consultancy based in Melbourne and a CVE Numbering Authority, working with schools and businesses across Australia.
Our thoughts are with the staff, students and families at All Souls St Gabriels. Incidents like this are hard on everyone involved, and the people working through it deserve support, not judgement.
Louay Ghashash is the Managing Director and Founder of Spartans Security, with more than 30 years of experience in information security. He has served as CISO for a number of organisations and advises clients across education, financial services, retail and government on security strategy, governance, risk and compliance. Louay chairs the Cyber Security Technical Advisory Board of the Australian Computer Society, is actively involved with ISACA Melbourne and the Australian Information Security Association, and holds the CISA, CISM, CRISC, CDPSE and ISO 27001 Lead Auditor certifications. You can connect with him on LinkedIn.
.png)
