Gentlemen ransomware uses multiple EDR killers to disable defenses
2026-06-19T01:23:29Z•b0322390198560990a1ef775168c6594fe0ba92b912e33e0fefeb98e4e67e420
Beats Studio BudsBluetooth eavesdroppingEDR evasionEvil CorpF5FortiBleedFortinetGentlemen RaaSIcarusKlueNGINXOAuth breachSalesforce data theftShapedPluginSocGholishTorUSB wormVPN credentials leakWindows Server 2016 patchingWordPress compromiseclipboard stealercritical vulnerabilitycrypto theftransomwaresupply chain
What happened
A collection of BleepingComputer reports (June 17–18, 2026) describing multiple active and high-impact threats: the Gentlemen RaaS is developing and deploying multiple EDR-killers to evade detection; a large Fortinet credential leak dubbed “FortiBleed” exposed VPN credentials for ~73k devices; F5 released out‑of‑band patches for multiple NGINX vulnerabilities including two critical RCEs; Apple patched a high‑severity Beats Studio Buds Bluetooth bug that could allow eavesdropping; WordPress sites were infected via a ShapedPlugin update supply‑chain compromise; law enforcement disrupted SocGholi
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- b0322390198560990a1ef775168c6594fe0ba92b912e33e0fefeb98e4e67e420
- Enrichment time
- 2026-06-19T01:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.