Thursday, 14 May 2026

The Gentlemen RaaS — backend "Rocket" database leaked (16.22 GB), Check Point analysis exposes operator handles, ZeroPulse C2 internals, 1,570+ victims, decryptor published on GitHub

UPDATE (originally covered 2026-05-10 in the Q1 2026 ransomware quarterly synthesis): Check Point Research published "Thus Spoke…The Gentlemen" on 2026-05-13, a detailed analysis of a 44.4 MB extract from the group's leaked "Rocket" backend database (16.22 GB total) that was posted to the cybercrime forum Breached on 2026-05-04 after the group's infrastructure was compromised by an unidentified actor (Check Point Research, 2026-05-13; BankInfoSecurity, 2026-05-11). The dataset contains 8,200 lines of internal chat-tool traffic across channels INFO / general / TOOLS / PODBOR, shadow files with password hashes, affiliate negotiation transcripts, and configuration artefacts for the ZeroPulse C2 framework.

Nine operator handles are identified — including administrator zeta88 (also hastalamuerte), who both manages the RaaS panel and participates directly in encryption events. Reconstructed attack chain: initial access almost exclusively via unpatched edge devices — FortiGate CVE-2024-55591 (the group's documented mainstay), Cisco appliances, CWMP/TR-069 interfaces — or purchased infostealer credentials; post-access tooling includes NetExec, RelayKing (NTLM relay), CertiHound (AD Certificate Services abuse), TaskHound, PrivHound; EDR-suppression utilities EDRStartupHinder, gfreeze and glinker manipulate ETW callbacks and NTDLL syscall tables; persistence is maintained via Cloudflare Zero Trust tunnels and self-provisioned WireGuard/OpenVPN chains.

Two operationally critical facts: (1) Check Point Research attributes a count of 1,570+ victim entries to a separately-exposed SystemBC C&C server, against 332 victims publicly listed on the group's data-leak site in the first five months of 2026 — significant under-reporting of true scope (Check Point's wider comparison cites 412 cumulative DLS listings); (2) the decryptor has been released as GitHub Bedrock-Safeguard/gentlemen-decryptor, enabling existing victims to recover without payment (decryptor disclosed in BankInfoSecurity's 2026-05-11 reporting). For Swiss / EU SOCs handling an active Gentlemen incident the workflow changes today: attempt decryption before any negotiation. Detection pivots from the leak: alert on EDRStartupHinder, gfreeze, glinker process names (custom binaries, not commodity); monitor for AD Certificate Services reconnaissance (certutil enumeration of CA servers and templates) consistent with CertiHound; correlate with FortiGate CVE-2024-55591 initial-access exploitation patterns that the group continues to weaponise.

Dutch IGJ rules Clinical Diagnostics/NMDL failed NEN 7510 information-security standard at time of July 2025 ransomware breach; ~941,000 patients affected, cervical-cancer screening data exposed

The Dutch Health & Youth Care Inspectorate (Inspectie Gezondheidszorg en Jeugd, IGJ) issued a public finding on 2026-05-13 concluding that Clinical Diagnostics LCPL BV and NMDL BV (Rijswijk) did not meet the mandatory NEN 7510 information-security standard at the time of their July 2025 ransomware breach, and had not fully remediated the deficiencies as of IGJ's December 2025 follow-up inspection (IGJ, 2026-05-13; native title: "Clinical Diagnostics voldeed niet aan wettelijke norm voor informatiebeveiliging" — "Clinical Diagnostics did not meet the statutory information-security standard"). NEN 7510 is the Dutch statutory information-security baseline for healthcare organisations under the Wabvpz, structurally aligned with ISO/IEC 27001 but extended for health-data obligations; non-compliance is independently actionable by multiple regulators.

IGJ's two named failures are foundational rather than technical: (1) no independent audit of the laboratory's information security had ever been performed, and (2) the organisation had not periodically assessed its processing risks, leaving it unable to determine which controls were necessary. The July 2025 breach — Computable's prior reporting attributes it to the Nova ransomware group — exposed approximately 941,000 patients' personal and medical records, including cervical-cancer screening results processed for the population-screening programme Bevolkingsonderzoek Nederland (Computable, 2026-05-13). IGJ has no fining power and has demanded short-term independent NEN 7510 certification; Autoriteit Persoonsgegevens (Dutch DPA), whose GDPR enforcement carries fines, is running a parallel investigation. IGJ also signalled sector-wide enforcement intent by publicly calling for all healthcare providers to demonstrate independent certification — a leading indicator of broader inspection cadence.

For a Swiss SOC the parallel is direct: NEN 7510 is the regulatory analogue of the EPDG (Bundesgesetz über das elektronische Patientendossier) security profile, and the two specific failures — absence of third-party audit, absence of periodic risk assessment — are the same hygiene-baseline gaps Swiss healthcare providers face under cantonal supervision. The breach scale (941k records, mass-screening data) is the proximate consequence of those structural gaps; the operationally useful read for defenders is detection of NEN-7510-style baseline gaps via third-party assessment, not signature hunting.

CVE-2026-0300 PAN-OS Captive Portal — patch wave 2 delayed to 2026-05-28 for eight high-traffic build streams; mitigation remains the only option on those builds

UPDATE (originally covered 2026-05-07 deep dive, last updated 2026-05-13): Palo Alto Networks PSIRT updated its CVE-2026-0300 advisory on 2026-05-13 to reflect first-wave patch availability but to also disclose a second patch wave with an ETA of 2026-05-28 for eight commonly-deployed build streams: PAN-OS 12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21 and 10.2.16-h7 (Palo Alto Networks PSIRT, updated 2026-05-13). Operators running any of those builds cannot patch yet; the interim mitigation — restrict User-ID Authentication Portal to trusted zones, or disable Captive Portal if unused — is the only option until 28 May. CL-STA-1132 in-the-wild exploitation continues; the cluster's tradecraft (EarthWorm / ReverseSocks5 tunnels, AD enumeration via firewall service account, deliberate log destruction) is unchanged from prior coverage (Unit 42 — Captive Portal Zero-Day, 2026-05-06).

The CISA KEV entry was updated on 2026-05-13 to note "Palo Alto has released a variety of patches"; the FCEB remediation deadline (2026-05-09) has already expired. Per PD-13 the KEV deadline is not the operational driver in CH/EU — the active-exploitation status, the affected-build delay, and the CL-STA-1132 attribution are. The wave-2 delay specifics are documented in the vendor PSIRT advisory and were not independently corroborated by HIGH-reliability third-party reporting in window; treat the eight-build "ETA 05/28" list as vendor-primary and verify against the live PSIRT entry before any rollout planning.

CVE-2026-8043 Ivanti Xtraction external file control (CVSS 9.6) plus EPM SQL-injection-to-RCE and vTM admin OS-command injection — May 2026 advisory batch, no ITW

Ivanti's May 2026 Security Update (2026-05-12) discloses four product-line advisories. The headline issue is CVE-2026-8043 in Ivanti Xtraction prior to 2026.2 — a CWE-73 (external control of file name or path) flaw rated 9.6 on CVSS 3.1 with PR:L (low-privilege auth required, not admin) and AC:L — letting a remote authenticated attacker read arbitrary server-side files and write arbitrary HTML into the web directory. The dual primitive is the operational concern: arbitrary HTML write into the web tree is a viable stored-XSS staging point against higher-privileged Xtraction users, and combined with the file-read primitive is sufficient to chain to web-shell drop in environments where the attacker can guess or read deployment paths.

Ivanti's EPM advisory in the same cycle addresses a SQL-injection vulnerability in the EPM web console prior to 2024 SU6 that any remote authenticated user can leverage. The relevant defender note is technique class, not just CVSS: SQL injection against EPM's SQL Server back-end is the well-documented xp_cmdshell (T1059) or stored-procedure code-execution pivot ransomware initial-access brokers have weaponised against EPM and analogous endpoint-management platforms for years. The third advisory covers an OS-command injection (T1059) in the Ivanti Virtual Traffic Manager (vTM) admin interface prior to 22.9r4, allowing an admin-credentialed attacker to inject OS commands and achieve full appliance RCE. Ivanti states no in-the-wild exploitation as of 2026-05-12 for any of the four advisories; CERT-FR (CERTFR-2026-AVI-0576, 2026-05-13) and SecurityWeek (2026-05-13) corroborated the disclosure within 24 hours.

Affected and fixed versions (per the vendor batch): Ivanti Xtraction < 2026.2 → 2026.2; Ivanti EPM ≤ 2024 SU6 → 2024 SU6; Ivanti vTM < 22.9r4 → 22.9r4. Inclusion gate cleared: CVE-2026-8043 sits in the ENISA EUVD CVSS 9.0–10.0 critical band on the vendor's CVSS 3.1 score. Detection priority for SOCs that operate Ivanti: monitor EPM web-console request logs for stored-procedure invocation patterns originating from non-administrative user contexts (T1505.003 web-shell + T1059 command-line), and audit Xtraction installations for any HTML file in the web tree whose timestamp post-dates 2026-04-01 and whose content does not match a release manifest. ATT&CK: T1190 Exploit Public-Facing Application, T1505.003 Web Shell, T1059 Command and Scripting Interpreter, T1190+T1505.003 chained for the Xtraction file-write to staged web-shell route. Xtraction is commonly deployed on internal management networks where egress controls are looser than perimeter — a successful T1041 (exfiltration over C2) post-compromise can go unnoticed longer than perimeter-edge compromises.

GemStuffer — RubyGems weaponised as a one-way exfiltration channel scraping UK local-authority ModernGov portals; new abuse pattern targets the asymmetric monitoring gap between package pull and push

Socket's Threat Research Team disclosed on 2026-05-13 a campaign it dubs GemStuffer, in which 155+ malicious Ruby packages were published to the public RubyGems registry — not as a malware-delivery vehicle but as a covert one-way data-exfiltration channel (Socket, 2026-05-13; The Hacker News, 2026-05-13). The technique is new enough to warrant a defender's attention regardless of jurisdiction: a public package registry's push API has hitherto been monitored for malware distribution, not for outbound data leakage. Socket notes RubyGems temporarily disabled new account registration in connection with the broader account-abuse pattern that GemStuffer is part of.

Attack-chain steps as reported by Socket: (1) reconnaissance of the execution environment to confirm gem CLI presence and writeable temp space; (2) HTTP scraping of UK local-government democratic-services portals running ModernGov — Lambeth, Wandsworth and Southwark councils — using Ruby's stdlib Net::HTTP with SSL verification suppressed; (3) packaging of scraped HTML responses (committee calendars, agenda items, officer contact data, linked PDFs) into syntactically valid .gem archives with the captured data placed in lib/result.txt or in README fields; (4) credential injection — three OAuth-format RubyGems API keys hard-coded as plaintext in the payloads, with ENV['HOME'] overridden to an attacker-controlled /tmp/gemhome/ directory containing fabricated .gem/credentials files (permissions 0600) so the CLI's credential lookup resolves to attacker values without touching the operator's real home directory; (5) exfiltration via gem push to the RubyGems API.

The scraped data is itself public (council democratic-services portals are by design public), so the operational significance is not the confidentiality of the data but the channel pattern. Socket flagged the possibility that "council portal access as a pivot to demonstrate capability against government infrastructure" is the actual objective. The defender-critical generalisation: most CI/CD pipeline monitoring instruments npm install / bundle install / pip install inbound; few instrument outbound npm publish / gem push / pip upload from non-publisher contexts. Analyst-derived ATT&CK mapping for the chain (not cited in Socket's write-up): T1583.001 Domains (registry abuse), T1027 Obfuscated Files (data embedded inside .gem structure), T1567.004 Exfiltration to Web Service, T1552.001 Credentials In Files (hard-coded API keys).

Detection priorities for any organisation with Ruby tool-chains in its development surface: (a) audit gem push and bundle exec gem push invocations from CI runners and developer workstations that do not have a publish role assigned; (b) flag new RubyGems publisher accounts with high version churn (>10 versions/day on a freshly created package); (c) inspect outbound HTTPS POST traffic from build agents to rubygems.org (POST = publish, GET = read); (d) extend the same lens to npm publish and pip upload. The asymmetric-monitoring-gap pattern generalises trivially across registries; the GemStuffer write-up is the lever for security teams to fund that monitoring asymmetry now rather than after a CH/EU-equivalent variant lands. RubyGems' temporary signup suspension is signal that the registry operator already considers this a structural rather than a single-actor problem.

FamousSparrow Three-Wave Intrusion of an Azerbaijani Energy Operator: ProxyNotShell Re-exploitation and a Wave-1 DLL-Sideload Loader That Overrides Two Hamachi Exports to Defeat Sandbox Analysis

Background. FamousSparrow has been tracked publicly since 2021 as a China-nexus espionage cluster targeting hotels, government and engineering firms; Bitdefender's 2026-05-13 write-up cites tooling and infrastructure overlap with the Earth Estries cluster, and The Hacker News summary additionally notes Salt Typhoon overlap. Recent primary technical detail has been sparse — the Bitdefender Labs publication on 2026-05-13 is the first multi-wave intrusion case study against an energy-sector victim published in some time (Bitdefender Labs, 2026-05-13; The Hacker News, 2026-05-13). The Azerbaijan targeting is geopolitically novel for the cluster: Bitdefender characterises Azerbaijani gas-export expansion to 13 European countries (with new flows to Germany and Austria) following the post-Ukraine-transit reconfiguration, making extraction and transit infrastructure intelligence operationally valuable to Chinese state actors monitoring European energy supply dependencies.

Victim, time-frame, framing. Bitdefender Labs documented a three-wave intrusion against an unnamed Azerbaijani oil and gas operator spanning December 2025 to February 2026, attributed with moderate-to-high confidence to FamousSparrow (also tracked as UAT-9244 in Talos taxonomy). The operationally most consequential framing is not the attribution but the fact that all three waves re-used the same Exchange initial access vector despite the victim's attempted remediation — the structural lesson is patch-completeness verification rather than novel-zero-day defence.

Vulnerability mechanics & initial access. Initial access in every wave exploited the ProxyNotShell chain — CVE-2022-41040 (SSRF in the Exchange front-end Auto-discover handler) chained with CVE-2022-41082 (deserialisation in the back-end PowerShell remoting endpoint) against an on-premises Microsoft Exchange Server. The vulnerable surface is the front-end Exchange Autodiscover.svc accepting a crafted IIS request that triggers internal SSRF to the Mailbox role's PowerShell remoting endpoint; the deserialisation in the chained PowerShell context yields code execution under the Exchange application-pool identity (typically LocalSystem on the mailbox server). The re-exploitation across three waves indicates either incomplete cumulative-update application (Microsoft's HealthChecker.ps1 is the canonical verification harness) or a persistence foothold — likely a web shell or scheduled task — that survived clean-up rounds and re-armed the same vulnerable code path.

Exploitation chain mapped to ATT&CK. Each wave deployed distinct payload combinations on top of the same initial-access foothold:

• T1190 Exploit Public-Facing Application — ProxyNotShell against Exchange (each wave).
• T1505.003 Server Software Component: Web Shell — surviving persistence from an earlier wave is the most plausible explanation for re-exploitation across remediation attempts.
• T1059.001 Command and Scripting Interpreter: PowerShell — Exchange PowerShell remoting deserialisation gadget yields PowerShell execution; subsequent reconnaissance and tooling drop.
• Wave 1: Deed RAT (Snappybee) deployed via DLL sideloading against a signed LogMeIn Hamachi binary — Deed RAT is the ShadowPad successor lineage (encrypted C2, file I/O, command execution, process injection). The sideloading is the technique-novelty highlight: per Bitdefender the malicious DLL overrides two of Hamachi's exported functions (Init, ComMain) and patches StartServiceCtrlDispatcherW, so the payload only executes when Hamachi's own service-start path runs. T1574.002 Hijack Execution Flow: DLL Side-Loading is the ATT&CK umbrella, but the override-and-patch detail is what defeats sandbox harnesses: stub harnesses that call DllMain or a small set of obvious exports never trigger Init / ComMain in the right order and the payload stays dormant.
• Wave 2: TernDoor deployed via DLL sideloading against a renamed-but-legitimate deskband_injector64.exe — Bitdefender records the second wave as introducing TernDoor as a second backdoor family. The sideloading host is deskband_injector64.exe renamed USOShared.exe and placed in C:\ProgramData\USOShared\; the malicious loader is winmm.dll in the same directory. (No legitimate Microsoft "USOShared" signed binary is involved — the directory name is reused for camouflage.)
• Wave 3: Modified Deed RAT with updated C2 infrastructure — Bitdefender's third wave is an evolution of Wave 1's implant (refreshed C2, no novel sideloading host), confirming the operator's preference for iterating on the Deed RAT line rather than abandoning it.
• T1078 Valid Accounts + T1021.001 RDP / T1021.002 SMB — lateral movement via Impacket, RDP, SMB tooling once the Exchange-server foothold is established.

Named clusters and shared tooling. Bitdefender's overlap assessment places FamousSparrow / UAT-9244 in operational relationship with Earth Estries (Trend Micro taxonomy); The Hacker News summary additionally connects the cluster to Salt Typhoon (Microsoft taxonomy). Implants observed include Deed RAT (Snappybee), TernDoor, Mofu Loader and ShadowPad ancestry; the LogMeIn Hamachi sideloading host is freshly observed for this cluster and indicates active tooling rotation rather than reuse of a known signed-binary host.

Detection and hunt concepts. Defender-actionable, behavioural — not IOCs:

• Exchange patch-verification audit: Run Microsoft's HealthChecker.ps1 against every on-premise Exchange server and review the output for Exchange Build and Hotfix Applied lines. CU-level patch status alone is insufficient — the cumulative-update installer occasionally rolls back fixes if an OWA front-end customisation conflicts. Cross-reference IIS log analysis for repeated POST requests to /autodiscover/autodiscover.json with non-empty bodies, especially when the same external IP returns over a span of days — the ProxyNotShell exploitation pattern leaves this footprint.
• Web-shell survival sweep: Audit the Exchange FrontEnd\HttpProxy\owa\auth\ and FrontEnd\HttpProxy\ecp\auth\ directories for files modified post-patch, and the Exchange transport-agents folder for unsigned scheduled tasks. Persistence outliving clean-up was the structural enabler of re-exploitation in this case.
• LogMeIn Hamachi / signed-binary sideload anomalies: Hunt for hamachi*.exe or logmein*.exe loading DLLs from non-standard installation paths, or any legitimately signed binary whose child process tree spawns cmd.exe / powershell.exe with encoded arguments. The export-override gating makes the loader resilient against generic sandbox detection, but the eventual payload still spawns shell children — Sysmon event ID 1 with ParentImage filter on known signed binaries and CommandLine patterns for -EncodedCommand / -enc remains effective. Wave 2's sideloading is the same class of abuse using a renamed legitimate binary — extend the hunt to deskband_injector64.exe running from non-standard paths (Bitdefender placed it as C:\ProgramData\USOShared\USOShared.exe) and to any winmm.dll load from a ProgramData subdirectory rather than from the system search path.
• DLL load-order anomaly hunt: T1574.002 sideloading depends on a writable DLL search path adjacent to the host binary. Hunt Sysmon event ID 7 (Image Load) records for the Hamachi process loading DLLs from %LOCALAPPDATA%\Temp\ or other writable user-context paths rather than from the legitimate Program Files\LogMeIn Hamachi\ install directory.
• Lateral-movement signatures: alert on Impacket execution patterns (smbexec.py / wmiexec.py) — process command lines containing \\127.0.0.1\admin$ and Win32 service installations with randomly-named binaries (__output style) on member servers. RDP from Exchange servers to non-administrative workstations is anomalous regardless of source-account legitimacy.

Hardening / mitigation. Concrete configuration toggles, not advice:

• Exchange: Apply the latest cumulative update and verify with HealthChecker.ps1; deploy Microsoft's mitigation script for ProxyNotShell-class URL rewriting if running an Exchange version still affected. Consider the broader move to Exchange Online for organisations that have not migrated — on-premises Exchange remains a top initial-access vector across China-nexus campaigns.
• Application-allow-listing: Enforce Windows Defender Application Control (WDAC) or AppLocker policies that disallow LOLBin-style execution of logmein*.exe / hamachi*.exe from %TEMP% / %LOCALAPPDATA% paths. Even legitimately signed binaries should not run from user-writable directories.
• EDR / Microsoft Defender for Endpoint: enable "Block executable content from email client and webmail" and "Block all Office applications from creating child processes" ASR rules; these do not directly catch the Hamachi sideload but harden adjacent ingress paths.
• Conditional Access: Require modern-authentication and device-compliance for OWA / EAS / Outlook desktop where Exchange Online or hybrid mailboxes are in use; legacy authentication on hybrid setups continues to expose ProxyNotShell-adjacent paths.

Operationally critical context for Swiss / EU public-sector SOCs. Per Bitdefender, Azerbaijani gas exports now reach 13 European countries including Germany and Austria — so energy-sector intelligence collection against an Azerbaijani operator is structurally collection against the upstream end of European energy supply. The ProxyNotShell-re-exploitation pattern documented here is not Azerbaijan-specific — any organisation in CH / EU with an on-premise Exchange server that received CU patches but lacks HealthChecker.ps1-level verification carries the same exposure. The Wave-3 export-gated sideloading technique generalises to any legitimate signed binary an operator chooses to abuse; defenders should treat it as a class problem (DLL sideloading from signed hosts) rather than a Hamachi-specific signature.