The Gentlemen Leak Analysis (Part 2) — JA456 Follow-on

Executive summary

JA456 is a follow-on package to the original “Gentlemen Leaks” (4 May 2026) — see Part 1: https://ransom-isac.org/blog/the-gentlemen-leak-analysis/. It appears to have been shared by the same source and was also posted on Cracked under the username n7778 (unverified).

Unlike typical leak packs focused solely on victim data, JA456 exposes operator-side artifacts: MEGA account session history and a Synology NAS shadow dump, plus screenshots taken during an apparent last-minute wipe. These artifacts provide rare visibility into tooling, timelines, and potential operator geolocation.

Why it matters / impact

• Attribution-grade infrastructure breadcrumbs: session IPs and device/tool fingerprints (MEGAsync/MEGAcmd, rclone) can be pivoted into broader infrastructure mapping and clustering.
• High-value lead: an early, pre-VPN residential Russian IP (92.39.211.142, Izhevsk/Udmurttelecom) may reflect an operator location prior to operational hardening. This IP may also be static and have been observed across multiple campaigns.
• Historical operator tooling: related infrastructure and activity has been associated with Cobalt Strike and Havoc C2 in 2023, suggesting a broader, multi-year tradecraft footprint beyond this leak set.
• Tradecraft confirmation: end-to-end exfil workflow (FortiGate access → credential tooling → lateral movement → Synology NAS staging → rclone/MEGA) aligns with modern ransomware affiliate playbooks.
• Downstream risk: confirmation of sensitive victim materials (pharma regulatory dossiers; Windows DC backup metadata including NTDS capture) indicates exposure and potential follow-on extortion/fraud risk.

What's in the package (at a glance)

• MEGA — GDPR export for a staging account used for exfiltration (sessions, IPs, tooling fingerprints).
• NAS — Synology /etc/shadow + screenshots documenting the NAS reset while exfiltration was still active.

What Is This

JA456 is a two-folder package dropped as a follow-on to the original Gentlemen Leaks. It contains data exfiltrated from the infrastructure of Zeta — a threat actor who was themselves compromised and wiped by The Gentlemen. The wider TheGentlemenLeak-main corpus confirms Zeta = The Gentlemen ransomware group, ranked #2 globally in 2026 (1,410 victims across 322 groups).

Package Contents

NAS /etc/shadow (from NAS/1.txt)

• Password-hash accounts (high signal): operator and crew/user accounts with hashes present in /etc/shadow (excerpt below).
• Locked/service accounts (low signal): Synology and service accounts typically present on DSM; shown for completeness.

Accounts with password hashes (excerpt)

┌───────────┬─────────┬────────────────────────────────┐
│  Account  │  Hash   │             Notes              │
├───────────┼─────────┼────────────────────────────────┤
│ zeta88    │ SHA-512 │ Primary operator               │
├───────────┼─────────┼────────────────────────────────┤
│ admin     │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ 3NT3R     │ SHA-512 │ min_age=100000 — locked        │
├───────────┼─────────┼────────────────────────────────┤
│ B1d3n     │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ C0CA      │ SHA-512 │ min_age=100000 — locked        │
├───────────┼─────────┼────────────────────────────────┤
│ d0wnloAd1 │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ equal1z3r │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ F3N1X     │ SHA-512 │ min_age=100000 — locked        │
├───────────┼─────────┼────────────────────────────────┤
│ Gblog88   │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ guest     │ MD5     │ Weak — legacy Synology default │
├───────────┼─────────┼────────────────────────────────┤
│ JLL       │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ LDW       │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ n0n3      │ SHA-512 │                                │
├───────────┼─────────┼────────────────────────────────┤
│ PRTGRS    │ SHA-512 │ min_age=100000 — locked        │
├───────────┼─────────┼────────────────────────────────┤
│ W1Z       │ SHA-512 │                                │
└───────────┴─────────┴────────────────────────────────┘

Locked / service accounts (no login, *)

anonymous, avahi, bind, daemon, dbus, dovecot, FileStation, ftp, http, HybridShare, HybridShareSystem, HyperBackup, ldap, lp, MEGAcmd, myds, mysql, nobody, ntp, OAuthService, postfix, postgres, Python2, QuickConnect, root, rpc, sc-rclone, SecureSignIn, StorageManager, SynoFinder, synoplugind, SynoRsyncd, synotss, system, SYSTEM_ADMIN, taskmgr, tokenmgr, videodriver, vmcomm

MEGA Account

[email protected] / [email protected] — alias “The G” — free tier, no contacts, no shared links.

Sessions

92.39.211.142 is the key lead — Udmurttelecom residential ISP in Izhevsk, Udmurt Republic. Active before VPN was set up. Chat message activity peaks at 17:00 UTC (20:00 MSK), consistent with UTC+4 (Izhevsk) timezone.

Confidence & caveats

• Claims explicitly labelled as “assessment” are analytical judgments based on the artifacts described in this report.
• The Cracked username n7778 is included as unverified reporting.
• IP geolocation and “residential vs. VPN” characterization is best-effort and may change with additional context (routing, CGNAT, leased blocks, VPN exit attribution).
• This report summarizes sensitive victim-side material at a high level and does not reproduce victim documents.

Timeline

Zeta's NAS

Synology SA6400 — 7 × TOSHIBA 18TB enterprise drives (~127TB) — serial 34POALFLF3XJ, firmware 1.13.2.

SFTP: 193.228.128.2:2222 user d0wnloAd1 (rclone config posted in plaintext by zeta88, 2026-02-14).

Crew accounts by onboarding date (from /etc/shadow)

3NT3R, F3N1X, C0CA have min_age=100000 — password change permanently blocked.

NAS Screenshots — Kill Chain

All four taken before the reset completed. Upload speed in frame 4 confirms exfil was still running as the wipe was triggered.

667.png — Storage Manager

Storage Manager — all drives healthy

Stage 1. Hardware documented: 7 drives, all Healthy, 29°C.

3934.png — Password Prompt

Admin password entry

Stage 2. Admin credentials entered.

017.png — Factory Reset Page

Factory Reset page open — 69KB/s down / 64.2KB/s up

Stage 3. Reset page open. Network I/O active — still exfiltrating.

7199.png — Confirmation Dialog

Factory Reset confirmation — 395KB/s up / 71KB/s down

Stage 4. “Are you sure?” on screen. 395 KB/s upload — draining the last data as the reset is confirmed.

Stolen Data on the NAS

Egyptian Pharmaceutical Company

Full regulatory dossier for an azithromycin-based eye ointment (Azithromycin 10mg/gm): NODCAR submission, R&D dossier, pilot batch manufacturing (rooms B156/B142, tanks PR-2011/PR-2010, API supplier identified), pricing, product inserts, internal .msg email chain.

Email headers exposed: AD domain [REDACTED], Exchange 2019 (v15.2.986.42), Kaspersky AV, servers 192.168.2.1–4, office egress [REDACTED] (TE Data Egypt), EDA contact [REDACTED].

Domain Controller Backup (2025-07-30, pre-NAS loot)

VSS backup with NTDS backupSucceeded=yes — ntds.dit captured alongside SYSVOL (confirms DC). All domain hashes were in Zeta's possession.

TTPs

CVE-2024-55591 (FortiGate, 98 targets) → XenAllPasswordPro for creds → NetExec lateral movement → victim FortiGates reused as VPN pivots (passwords gentlemen25/gentle26) → /opt/update NAS encryptor on Synology DSM → rclone to NAS → MEGA. G-BOT custom C2 with SOCKS5.

Selected victims

Arcelik/Beko (TR) · Adaptavist Group (UK, ScriptRunner source code) · Flex Ltd (US Fortune 500) · Elundini Municipality (ZA gov) · AgroRural (PE gov) · Times Software (SG) · Ghana Bauxite · Florida Pain Management (medical PII + CC data)

Black Basta link: Matrix logs from bestflowers247.online in screenshots. zeta88 on Devman: “девмана толи приняли толи по здоровью толи ребренд — всё пропал” (“arrested, health issues, or rebranded — gone”). Devman = Oleg Nefedov, DOB 03.06.1990, BKA/Europol/Interpol warrant.

IOCs

Infrastructure & IP breakdown

Operator infrastructure

FortiGate pivot IPs (compromised victims reused as VPN)

Recommended actions (defenders)

• Add the listed IOCs to monitoring/blocking where appropriate, and set alerts on new infrastructure resolving from the same clusters.
• Hunt for rclone usage and configuration artifacts on endpoints and servers (common staging/exfil indicator), alongside MEGA tooling where relevant.
• Review edge exposure and telemetry for FortiGate compromise patterns; validate credential access tooling and lateral movement artifacts.
• For impacted environments, validate potential domain compromise paths consistent with NTDS/SYSVOL access and implement credential resets and tiered admin controls.
• Treat the Izhevsk lead (92.39.211.142) as a pivot for historical campaign linkage (including 2023 C2 tooling associations) rather than a single-point attribution indicator.

Attribution (assessment)

Russia (assessment). Key lead: Izhevsk, Udmurt Republic (Udmurttelecom, 92.39.211.142). Timezone indicators are consistent with UTC+4 (Izhevsk), and Windows 10 build 19044 is observed throughout. Infrastructure suggests self-hosted VPN (AmneziaVPN / WireGuard) and compromised FortiGates used as pivots.

Additional context: 92.39.211.142 is assessed as possibly static and may have been used across multiple campaigns. Related infrastructure and activity have also been associated with Cobalt Strike and Havoc C2 in 2023, indicating a broader tradecraft footprint beyond this leak set.

Conclusion

JA456 is notable because it exposes operator-side artifacts rather than only victim-side documents. The combination of MEGA session history, NAS account artifacts, and wipe-in-progress screenshots provides rare pivots for clustering infrastructure and assessing operator location and tradecraft. We recommend treating the Izhevsk residential IP lead (92.39.211.142) as a priority pivot for additional campaign linkage and infrastructure mapping.