Cane doesn't wait
On 10 June 2026 the ransomware group The Gentlemen stopped two Mackay Sugar mills in Australia without touching a single industrial system — a hole in FortiOS was enough. Here's how it happened and what to do so you're not among the 14,700 FortiGates already breached.
Early on the morning of 10 June 2026, farmers around Mackay, Australia, got a
message: **stop harvesting immediately**.
Two of the three mills of Mackay Sugar, Australia's second-largest raw sugar
producer, had stopped. Not a boiler, not a flood, not a strike. Someone on the
other side of the planet pressed Enter.
Cut cane starts losing sugar content from the first minute. You can't put it in a
warehouse and wait for IT to bring the ERP back up. Two days later the company
switched to **manual crushing** — people doing by hand what systems normally do,
just so the crop wouldn't rot.
1,300 grower farms. A week and a half of downtime that moved to the end of the
season — into the rains and falling sugar content.
## Who
Six days later **The Gentlemen** claimed responsibility — a RaaS group that split
from Qilin after a dispute over $48,000 in unpaid money. By June 2026: 117 victims
in a month, the year's second most active program. Affiliates are paid 90% of the
ransom against the market's 70–80%. The encryptors run on Windows, Linux and ESXi.
## How
The main vector is **CVE-2024-55591**, an authentication bypass in FortiOS/FortiProxy.
Not phishing. Your firewall.
The group maintains a database of roughly **14,700 already exploited FortiGates**
worldwide and 969 verified FortiGate VPN accounts. That's not a target list. It's a
list of doors already forced open, waiting their turn.
## The key takeaway
No traces of access to the industrial control systems were found. And that is the
most important part.
**To stop a plant, you don't need to hack the plant.** It's enough to take down the
systems the plant can't run without: planning, raw-material accounting, logistics,
the weighbridge. The gears keep turning — but nobody can say what to feed them.
Dragos for Q2 2026: 1,140 industrial ransomware incidents, 65% in manufacturing.
The culprits aren't ICS implants but ERP, hypervisors, AD and VPN gateways.
## What to do
1. Close CVE-2024-55591 on every FortiGate. Including the one at the branch.
2. Patched ≠ clean. Hunt for traces and rotate all admin and VPN credentials.
3. MFA on VPN with no exceptions. The exception is what becomes the way in.
4. Detection: SharpADWS, Advanced IP Scanner, `netsh trace`, and top priority —
clearing of the security log (Event ID 1102).
5. Isolate ESXi: a separate segment, SSH disabled, lockdown mode.
6. A 72-hour manual mode for the critical flow. Documented and rehearsed.
For critical information infrastructure in Uzbekistan, add notifying the State
Security Service within 48 hours (Article 23 of Law ZRU-764) — write it into the
runbook **before** an incident, not during one.
---
A list of 14,700 entries. Check whether you're on it.
If you're not sure what exactly sits on your perimeter and who can control it —
[request a demo](/contact): in 15 minutes we'll go through your infrastructure and
tell you where a similar hole might be.