Gentlemen ransomware uses a collection of EDR-killing tools, notably GentleKiller with at least eight variants, to disable endpoint defenses early in attacks. These tools impersonate legitimate security products and use the 'bring your own vulnerable driver' technique to escalate privileges to kernel level and disable security engines. GentleKiller targets over 400 processes related to approximately 48 security vendors. The ransomware group also integrates external EDR killers like HexKiller, ThrottleBlood, and HavocKiller, and uses a Rust-based credential stealer named OxideHarvest. The framework is designed for easy adaptation to new vulnerable drivers. The group selects targets based on FortiGate endpoint configurations and has been linked to attacks on corporate victims including a Romanian energy provider. No official patch or remediation guidance is available.

The use of multiple sophisticated EDR killers allows Gentlemen ransomware affiliates to disable a wide range of endpoint security products, increasing the likelihood of successful ransomware deployment and data theft. By gaining kernel-level privileges through vulnerable drivers, the attackers can evade detection and prevent security tools from interfering with their operations. The targeting of numerous security vendors' processes indicates a broad capability to bypass defenses. The inclusion of credential stealing further increases the threat to victim organizations. This capability enhances the ransomware group's operational effectiveness and complicates incident response.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor vendor advisories for updates on vulnerable drivers and potential patches. Given the use of stolen or invalid digital signatures and packed binaries, enhanced detection techniques focusing on behavior and anomaly detection may be necessary. FortiGate endpoint configurations should be reviewed as they appear to influence targeting. No official fix or mitigation is currently documented for the EDR killers themselves.