THEGENTLEMEN, Gunra, INC Ransom hit Latin America

THEGENTLEMEN added 25 new victim posts to its leak site, with 14 cases appearing in a 24-hour span on 2026-08-06, while Gunra and INC Ransom also expanded their activity and alerts across Latin America. Security Arsenal, Dragos, CISA, BleepingComputer, Bitdefender, PlainSec and Check Point Research pointed to pressure on VPNs, firewalls and industrial sectors.

Which sectors and attack vectors were most exposed?

Manufacturing and professional services were the sectors with the most THEGENTLEMEN victims, according to Security Arsenal, which also included technology and SaaS, agriculture and food, government and defense, retail and e-commerce, healthcare and uncategorized cases.

The firm also identified the most likely primary attack vector as abuse of edge devices such as VPN gateways, firewalls and remote access tools. It also mentioned, as a likely vector, a CVE in Check Point Security Gateway, although that point was described as not officially confirmed.

On another front, Check Point Research placed The Gentlemen at 125 claims for the quarter, the largest increase among established groups in the period, and said a May internal leak exposed the operation's structure and tooling. Later, HIPAA Journal reported that AnMed was investigating the data breach claimed by The Gentlemen, although it did not name the group in its own communication; the coverage also said the hospital had closed nearly 80 facilities while dealing with the cyberattack.

What did the regional ransomware activity show?

The regional picture showed broader activity, and Dragos reported that in the second quarter of 2026, industrial ransomware activity in South America reached 64 incidents, with Brazil and Argentina accounting for half of that total.

According to that analysis, the hardest-hit sectors were manufacturing, transportation and engineering.

What was reported about INC Ransom in the region?

Coverage on INC Ransom indicated that the group had listed victims in Colombia on its leak site since early August and also mentioned victims in the United States, Australia, the United Arab Emirates, Colombia and Switzerland.

That same coverage attributed to INC Ransom the active exploitation of two recent SonicWall SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, to enable unauthenticated access and privilege escalation.

BleepingComputer added that CISA and SonicWall had already warned about the active exploitation, with patches published in mid-July and no workaround available.

Bitdefender, for its part, said multiple investigations attribute to INC Ransom the chaining of both flaws since June 2026 to raise privileges, access credentials and configuration files, and deploy malware in later stages.

What did the official response warn about Gunra?

CISA and partners issued a joint advisory with detection and mitigation guidance, and the notice was released by the FBI, CISA, NSA, DC3, the U.S. Secret Service and South Korea's National Police Agency.

The advisory identifies initial access as having been achieved by exploiting two Fortinet vulnerabilities, CVE-2024-55591 and CVE-2025-24472, both in FortiOS and FortiProxy.

Independent coverage added that Gunra has been seen targeting Fortinet firewalls to gain initial access through two critical authentication vulnerabilities in FortiOS and FortiProxy, and that it is targeting sectors including healthcare, public health, financial services and government services.

CISA also recommended prioritizing patching for known vulnerabilities in internet-facing systems, such as VPN gateways and RDP, along with network segmentation and offline, immutable backups.

Coverage from The Hacker News said the operation is described as double extortion, while PlainSec added that Gunra has also used a Schneider Electric PowerLogic P5 vulnerability, extending its initial access chain beyond FortiOS and FortiProxy.